Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
zed.exe

Overview

General Information

Sample name:zed.exe
Analysis ID:1566096
MD5:faecb8128727e4d7b36e49b3161a2c9e
SHA1:9a5d8f5d46aad666da03ab21f5b791c69522b279
SHA256:e46cd48eecbb40507489635dd6323a2d2e1da717985f8894919860353f45f02b
Tags:exeusjjsjsj-com-nguser-JAMESWT_MHT
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Deletes shadow drive data (may be related to ransomware)
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • zed.exe (PID: 7948 cmdline: "C:\Users\user\Desktop\zed.exe" MD5: FAECB8128727E4D7B36E49B3161A2C9E)
    • zed.exe (PID: 8140 cmdline: "C:\Users\user\Desktop\zed.exe" MD5: FAECB8128727E4D7B36E49B3161A2C9E)
      • powershell.exe (PID: 2088 cmdline: powershell -Command "Disable-ComputerRestore -Drive C:\\" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1424 cmdline: powershell -Command "Enable-ComputerRestore -Drive C:\\" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • vssadmin.exe (PID: 6972 cmdline: vssadmin delete shadows /for=C: /all /quiet MD5: B58073DB8892B67A672906C9358020EC)
        • conhost.exe (PID: 1076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Source: Process startedAuthor: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: vssadmin delete shadows /for=C: /all /quiet, CommandLine: vssadmin delete shadows /for=C: /all /quiet, CommandLine|base64offset|contains: vh, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: "C:\Users\user\Desktop\zed.exe", ParentImage: C:\Users\user\Desktop\zed.exe, ParentProcessId: 8140, ParentProcessName: zed.exe, ProcessCommandLine: vssadmin delete shadows /for=C: /all /quiet, ProcessId: 6972, ProcessName: vssadmin.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Disable-ComputerRestore -Drive C:\\", CommandLine: powershell -Command "Disable-ComputerRestore -Drive C:\\", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\zed.exe", ParentImage: C:\Users\user\Desktop\zed.exe, ParentProcessId: 8140, ParentProcessName: zed.exe, ProcessCommandLine: powershell -Command "Disable-ComputerRestore -Drive C:\\", ProcessId: 2088, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: zed.exeVirustotal: Detection: 18%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
Source: zed.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: zed.exe, 00000008.00000002.2554885693.00007FF820AF2000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: zed.exe, 00000008.00000002.2550907096.00007FF820191000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: cryptography_rust.pdbc source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: zed.exe, 00000008.00000002.2554191441.00007FF820684000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: zed.exe, 00000006.00000003.1279553215.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558993887.00007FF832813000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: zed.exe, 00000008.00000002.2550907096.00007FF8200F9000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: zed.exe, 00000006.00000003.1279553215.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558993887.00007FF832813000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: zed.exe, 00000008.00000002.2553699562.00007FF8205A8000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: zed.exe, 00000008.00000002.2550907096.00007FF820191000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: zed.exe, 00000006.00000003.1279716134.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558231566.00007FF8313D5000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: zed.exe, 00000008.00000002.2558859645.00007FF832163000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: zed.exe, 00000008.00000002.2558474117.00007FF8313F1000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2555889916.00007FF821467000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2557002717.00007FF821A5C000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: zed.exe, 00000008.00000002.2556332736.00007FF821A02000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2557820528.00007FF831333000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2557002717.00007FF821A5C000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558033578.00007FF83134E000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: zed.exe, 00000008.00000002.2558697196.00007FF8314A4000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2556855887.00007FF821A29000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: cryptography_rust.pdb source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: zed.exe, 00000008.00000002.2558697196.00007FF8314A4000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: zed.exe, 00000008.00000002.2543113259.00000185B0C70000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: zed.exe, 00000006.00000003.1279716134.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558231566.00007FF8313D5000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdb source: zed.exe, 00000008.00000002.2554191441.00007FF820684000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: zed.exe, 00000008.00000002.2554472661.00007FF8206DD000.00000002.00000001.01000000.00000014.sdmp
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6479280 FindFirstFileExW,FindClose,6_2_00007FF6C6479280
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6491874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,6_2_00007FF6C6491874
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,6_2_00007FF6C64783C0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6479280 FindFirstFileExW,FindClose,8_2_00007FF6C6479280
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6491874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,8_2_00007FF6C6491874
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,8_2_00007FF6C64783C0
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79482\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\Jump to behavior
Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox ViewIP Address: 172.67.74.152 172.67.74.152
Source: unknownDNS query: name: api.ipify.org
Source: unknownDNS query: name: api.ipify.org
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: api.ipify.org
Source: zed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: zed.exe, 00000008.00000002.2543645311.00000185B1454000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2388000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B21E9000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCe
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: zed.exe, 00000008.00000003.1377108521.00000185B0F5E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372835509.00000185B0F8A000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373471204.00000185B0F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: zed.exe, 00000008.00000003.1376893151.00000185B142E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373663226.00000185B142E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373143309.00000185B142E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372761146.00000185B13E3000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372761146.00000185B138C000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373143309.00000185B13E6000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: zed.exe, 00000008.00000002.2541544617.00000185AEFEF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: zed.exe, 00000008.00000002.2543645311.00000185B1319000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlk
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlV
Source: zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crle
Source: zed.exe, 00000008.00000002.2544271136.00000185B16C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: zed.exe, 00000008.00000002.2543645311.00000185B1454000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: zed.exe, 00000008.00000002.2544271136.00000185B16C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: zed.exe, 00000008.00000002.2543645311.00000185B1454000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: zed.exe, 00000008.00000002.2544271136.00000185B16C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: zed.exe, 00000008.00000002.2543645311.00000185B1454000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B21E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: zed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544759419.00000185B1C40000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2546609856.00000185B29F8000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2546609856.00000185B2A80000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545402621.00000185B22EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: zed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B134F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tar.gz
Source: zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tgz
Source: zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B151F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: powershell.exe, 0000000B.00000002.1482082942.000001C198F2E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1482082942.000001C199065000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: zed.exe, 00000008.00000002.2544271136.00000185B16C5000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2546609856.00000185B2A80000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0E68000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: zed.exe, 00000008.00000002.2543566402.00000185B11E0000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543486267.00000185B10C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: powershell.exe, 0000000E.00000002.1511110250.0000023030B62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: zed.exe, 00000008.00000002.2541544617.00000185AEFEF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: powershell.exe, 0000000B.00000002.1465650962.000001C188EB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: zed.exe, 00000008.00000002.2546609856.00000185B29F8000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2546901893.00000185B2AC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: zed.exe, 00000008.00000002.2545486870.00000185B2388000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B21E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: zed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: powershell.exe, 0000000B.00000002.1465650962.000001C18A306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000E.00000002.1511110250.0000023030B62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: zed.exe, 00000008.00000002.2543566402.00000185B11E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/-
Source: zed.exe, 00000008.00000002.2545486870.00000185B2388000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B21E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F951473000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000002.2540933666.000001F95145D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: zed.exe, 00000008.00000003.1376728924.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ietf.org/rfc/rfc1421.txt
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ietf.org/rfc/rfc1423.txt
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ietf.org/rfc/rfc3447.txt
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ietf.org/rfc/rfc5208.txt
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: zed.exe, 00000008.00000002.2544271136.00000185B16C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: zed.exe, 00000008.00000002.2553503567.00007FF820598000.00000008.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.zlib.net/D
Source: zed.exe, 00000008.00000002.2544189975.00000185B1656000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B134F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: powershell.exe, 0000000B.00000002.1465650962.000001C188EB1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
Source: zed.exe, 00000008.00000002.2546901893.00000185B2B10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
Source: zed.exe, 00000008.00000002.2544432815.00000185B1800000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
Source: zed.exe, 00000008.00000002.2553915718.00007FF8205DC000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: powershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: zed.exe, 00000008.00000002.2543215029.00000185B0DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: zed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: zed.exe, 00000008.00000002.2542103956.00000185B0820000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: zed.exe, 00000008.00000003.1366205665.00000185B0970000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: zed.exe, 00000008.00000003.1366205665.00000185B0970000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: zed.exe, 00000008.00000003.1366205665.00000185B0970000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: zed.exe, 00000008.00000002.2542103956.00000185B0820000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: zed.exe, 00000008.00000002.2542977153.00000185B0B70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: zed.exe, 00000008.00000002.2542977153.00000185B0B70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: zed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: zed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: zed.exe, 00000008.00000003.1377108521.00000185B0F5E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://flak.tedunangst.com/post/new-openssh-key-format-and-bcrypt-pbkdf
Source: zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: powershell.exe, 0000000E.00000002.1511110250.0000023030B62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: zed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: zed.exe, 00000008.00000003.1372835509.00000185B0F8A000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/platformdirs/platformdirs
Source: zed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
Source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: zed.exe, 00000008.00000002.2543566402.00000185B11E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
Source: zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: zed.exe, 00000008.00000002.2542103956.00000185B0820000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: zed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: zed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: zed.exe, 00000008.00000003.1371568605.00000185B0F43000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0DA0000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1371607532.00000185B0F2F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372050627.00000185B0F5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: zed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: zed.exe, 00000008.00000002.2544759419.00000185B1C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: zed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2542620851.00000185B097D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: zed.exe, 00000008.00000002.2544759419.00000185B1C40000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0E68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: zed.exe, 00000008.00000002.2543566402.00000185B11E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: zed.exe, 00000008.00000003.1373057741.00000185B147A000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373143309.00000185B13E6000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376893151.00000185B13BD000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373663226.00000185B13CB000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: powershell.exe, 0000000B.00000002.1482082942.000001C198F2E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1482082942.000001C199065000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: powershell.exe, 0000000B.00000002.1465650962.000001C18A306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
Source: powershell.exe, 0000000B.00000002.1465650962.000001C18A306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
Source: zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1377574547.00000185B148A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/All
Source: zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1377409408.00000185B1571000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1377574547.00000185B148A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: zed.exe, 00000008.00000003.1377108521.00000185B0F4F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376893151.00000185B135F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: zed.exe, 00000008.00000003.1369760102.00000185B0E29000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543404964.00000185B0FC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
Source: zed.exe, 00000008.00000002.2554885693.00007FF820AF2000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
Source: zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0685/
Source: zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/build/).
Source: zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: zed.exe, 00000008.00000002.2544879514.00000185B2164000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: zed.exe, 00000008.00000002.2544879514.00000185B2164000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.ioEI79482
Source: zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: zed.exe, 00000008.00000003.1370601913.00000185B0EDF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0EF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: zed.exe, 00000008.00000003.1370601913.00000185B0EDF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0E98000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0EF8000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1374443659.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370706085.00000185B0DA9000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373471204.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370706085.00000185B0E71000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1371651313.00000185B0F21000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370887345.00000185B0E76000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: zed.exe, 00000008.00000002.2543404964.00000185B0FC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: zed.exe, 00000008.00000003.1370601913.00000185B0EDF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0EF8000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370601913.00000185B0EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
Source: zed.exe, 00000008.00000003.1370601913.00000185B0EDF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0EF8000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370601913.00000185B0EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
Source: zed.exe, 00000008.00000002.2545913117.00000185B2503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.apple.com/en-us/HT20PyP
Source: zed.exe, 00000008.00000002.2543645311.00000185B151F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: zed.exe, 00000008.00000002.2545486870.00000185B2388000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B21E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: zed.exe, 00000008.00000003.1373380848.00000185B143B000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373471204.00000185B0EBC000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0E65000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0E68000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373471204.00000185B0E4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: zed.exe, 00000008.00000002.2545052666.00000185B21BF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2546609856.00000185B2A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc8017
Source: zed.exe, 00000008.00000002.2545052666.00000185B21BF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc8017#page-67
Source: zed.exe, 00000008.00000002.2545052666.00000185B21BF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc8017#section-8.1.1
Source: zed.exe, 00000008.00000002.2545052666.00000185B21BF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc8017#section-8.1.2
Source: zed.exe, 00000008.00000002.2542620851.00000185B097D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: zed.exe, 00000008.00000002.2544759419.00000185B1C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://usjjsjsj.com.ng/post_fenec_key_user.php?userID=
Source: zed.exe, 00000008.00000003.1373471204.00000185B0EBC000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372761146.00000185B13E3000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372761146.00000185B138C000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373143309.00000185B13E6000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0E65000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0E68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: zed.exe, 00000008.00000002.2554249700.00007FF8206BF000.00000002.00000001.01000000.00000015.sdmp, zed.exe, 00000008.00000002.2551378116.00007FF82023A000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://www.openssl.org/H
Source: zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: zed.exe, 00000008.00000003.1373057741.00000185B147A000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373143309.00000185B13E6000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376893151.00000185B13BD000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373663226.00000185B13CB000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: zed.exe, 00000008.00000002.2555353226.00007FF820C68000.00000008.00000001.01000000.00000005.sdmpString found in binary or memory: https://www.python.org/psf/license/
Source: zed.exe, 00000008.00000002.2554885693.00007FF820AF2000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: https://www.python.org/psf/license/)
Source: zed.exe, 00000008.00000002.2543645311.00000185B134F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723

Spam, unwanted Advertisements and Ransom Demands

barindex
Deletes shadow drive data (may be related to ransomware)
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /for=C: /all /quiet
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /for=C: /all /quietJump to behavior
May disable shadow drive data (uses vssadmin)
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /for=C: /all /quiet
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /for=C: /all /quietJump to behavior
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\zed.exeFile deleted: C:\Users\user\Desktop\EOWRVPQCCS.pngJump to behavior
Source: C:\Users\user\Desktop\zed.exeFile deleted: C:\Users\user\Desktop\EEGWXUHVUG.jpgJump to behavior
Source: C:\Users\user\Desktop\zed.exeFile deleted: C:\Users\user\Desktop\QNCYCDFIJJ\SUAVTZKNFL.jpgJump to behavior
Source: C:\Users\user\Desktop\zed.exeFile deleted: C:\Users\user\Desktop\EWZCVGNOWT.mp3Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile deleted: C:\Users\user\Desktop\QNCYCDFIJJ.docxJump to behavior
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64710006_2_00007FF6C6471000
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6495C006_2_00007FF6C6495C00
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64969646_2_00007FF6C6496964
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64789E06_2_00007FF6C64789E0
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64887946_2_00007FF6C6488794
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64817406_2_00007FF6C6481740
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6481F606_2_00007FF6C6481F60
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64798006_2_00007FF6C6479800
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64940AC6_2_00007FF6C64940AC
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64918746_2_00007FF6C6491874
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64908C86_2_00007FF6C64908C8
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64880E46_2_00007FF6C64880E4
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64835A06_2_00007FF6C64835A0
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6481D546_2_00007FF6C6481D54
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C648E5706_2_00007FF6C648E570
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6495E7C6_2_00007FF6C6495E7C
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6489EA06_2_00007FF6C6489EA0
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64997286_2_00007FF6C6499728
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C648DEF06_2_00007FF6C648DEF0
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6481B506_2_00007FF6C6481B50
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6493C106_2_00007FF6C6493C10
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6482C106_2_00007FF6C6482C10
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64908C86_2_00007FF6C64908C8
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64964186_2_00007FF6C6496418
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647ACAD6_2_00007FF6C647ACAD
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647A4746_2_00007FF6C647A474
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6485D306_2_00007FF6C6485D30
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64839A46_2_00007FF6C64839A4
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64819446_2_00007FF6C6481944
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64821646_2_00007FF6C6482164
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C648DA5C6_2_00007FF6C648DA5C
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647A2DB6_2_00007FF6C647A2DB
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64710008_2_00007FF6C6471000
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64969648_2_00007FF6C6496964
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64887948_2_00007FF6C6488794
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64817408_2_00007FF6C6481740
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6481F608_2_00007FF6C6481F60
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64798008_2_00007FF6C6479800
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64940AC8_2_00007FF6C64940AC
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64918748_2_00007FF6C6491874
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64908C88_2_00007FF6C64908C8
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64880E48_2_00007FF6C64880E4
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64835A08_2_00007FF6C64835A0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6481D548_2_00007FF6C6481D54
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C648E5708_2_00007FF6C648E570
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6495E7C8_2_00007FF6C6495E7C
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6489EA08_2_00007FF6C6489EA0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64997288_2_00007FF6C6499728
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C648DEF08_2_00007FF6C648DEF0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6481B508_2_00007FF6C6481B50
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6493C108_2_00007FF6C6493C10
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6482C108_2_00007FF6C6482C10
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6495C008_2_00007FF6C6495C00
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64908C88_2_00007FF6C64908C8
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64964188_2_00007FF6C6496418
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C647ACAD8_2_00007FF6C647ACAD
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C647A4748_2_00007FF6C647A474
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6485D308_2_00007FF6C6485D30
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64839A48_2_00007FF6C64839A4
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64819448_2_00007FF6C6481944
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64821648_2_00007FF6C6482164
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64789E08_2_00007FF6C64789E0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C648DA5C8_2_00007FF6C648DA5C
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C647A2DB8_2_00007FF6C647A2DB
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F0F20D08_2_00007FF81F0F20D0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F101FB08_2_00007FF81F101FB0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1023E08_2_00007FF81F1023E0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1148108_2_00007FF81F114810
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1145C08_2_00007FF81F1145C0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1235208_2_00007FF81F123520
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1229B08_2_00007FF81F1229B0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F122EB08_2_00007FF81F122EB0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1224908_2_00007FF81F122490
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F121FE08_2_00007FF81F121FE0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F121D708_2_00007FF81F121D70
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1321208_2_00007FF81F132120
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F131D308_2_00007FF81F131D30
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F141F008_2_00007FF81F141F00
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1421E08_2_00007FF81F1421E0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1618808_2_00007FF81F161880
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F1612F08_2_00007FF81F1612F0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F2960C08_2_00007FF81F2960C0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F337FE08_2_00007FF81F337FE0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F37E6408_2_00007FF81F37E640
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F2955D28_2_00007FF81F2955D2
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F3E02D08_2_00007FF81F3E02D0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F30B9F08_2_00007FF81F30B9F0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F3AB0508_2_00007FF81F3AB050
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F3480608_2_00007FF81F348060
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F33D0108_2_00007FF81F33D010
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F2990508_2_00007FF81F299050
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F2A30E08_2_00007FF81F2A30E0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F2AFF308_2_00007FF81F2AFF30
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F2987108_2_00007FF81F298710
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F3C27108_2_00007FF81F3C2710
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F473D008_2_00007FF81F473D00
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F4BF9108_2_00007FF81F4BF910
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F51568E8_2_00007FF81F51568E
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F4513108_2_00007FF81F451310
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F5172308_2_00007FF81F517230
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F4550808_2_00007FF81F455080
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F5263708_2_00007FF81F526370
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F4420F08_2_00007FF81F4420F0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F52BF708_2_00007FF81F52BF70
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F455FB08_2_00007FF81F455FB0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F4CFE208_2_00007FF81F4CFE20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FF7BED381F211_2_00007FF7BED381F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FF7BED3744611_2_00007FF7BED37446
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00007FF7BEF481F214_2_00007FF7BEF481F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00007FF7BEF4744614_2_00007FF7BEF47446
Source: C:\Users\user\Desktop\zed.exeCode function: String function: 00007FF6C6472710 appears 104 times
Source: C:\Users\user\Desktop\zed.exeCode function: String function: 00007FF81F37A3F0 appears 250 times
Source: C:\Users\user\Desktop\zed.exeCode function: String function: 00007FF6C6472910 appears 34 times
Source: unicodedata.pyd.6.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.6.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: zlib1.dll.6.drStatic PE information: Number of sections : 12 > 10
Source: python3.dll.6.drStatic PE information: No import functions for PE file found
Source: zed.exe, 00000006.00000003.1280257582.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1281312189.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1279553215.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs zed.exe
Source: zed.exe, 00000006.00000003.1280434338.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1279716134.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs zed.exe
Source: zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs zed.exe
Source: zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs zed.exe
Source: zed.exeBinary or memory string: OriginalFilename vs zed.exe
Source: zed.exe, 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenametcl86.dllP vs zed.exe
Source: zed.exe, 00000008.00000002.2558111775.00007FF831353000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2557901068.00007FF831336000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2553781083.00007FF8205AE000.00000002.00000001.01000000.00000018.sdmpBinary or memory string: OriginalFilename_tkinter.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2543113259.00000185B0C70000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs zed.exe
Source: zed.exe, 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: OriginalFilenametk86.dllP vs zed.exe
Source: zed.exe, 00000008.00000002.2558532077.00007FF8313FE000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2554249700.00007FF8206BF000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamelibsslH vs zed.exe
Source: zed.exe, 00000008.00000002.2556418840.00007FF821A0E000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2558777401.00007FF8314A8000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2558912047.00007FF832166000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2555945366.00007FF82146E000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2558340118.00007FF8313D9000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs zed.exe
Source: zed.exe, 00000008.00000002.2559049293.00007FF832819000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs zed.exe
Source: zed.exe, 00000008.00000002.2556914944.00007FF821A33000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2557093567.00007FF821A65000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs zed.exe
Source: zed.exe, 00000008.00000002.2551378116.00007FF82023A000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs zed.exe
Source: zed.exe, 00000008.00000002.2553503567.00007FF820598000.00000008.00000001.01000000.0000001B.sdmpBinary or memory string: OriginalFilenamezlib1.dll* vs zed.exe
Source: zed.exe, 00000008.00000002.2555800305.00007FF820D91000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamepython312.dll. vs zed.exe
Source: zed.exe, 00000008.00000002.2554617144.00007FF8206F9000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs zed.exe
Source: classification engineClassification label: mal68.rans.evad.winEXE@12/1116@1/1
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\Desktop\ips.txtJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6032:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1076:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482Jump to behavior
Source: zed.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\zed.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: zed.exeVirustotal: Detection: 18%
Source: zed.exeString found in binary or memory: -startline must be less than or equal to -endline
Source: zed.exeString found in binary or memory: -help
Source: C:\Users\user\Desktop\zed.exeFile read: C:\Users\user\Desktop\zed.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\zed.exe "C:\Users\user\Desktop\zed.exe"
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Users\user\Desktop\zed.exe "C:\Users\user\Desktop\zed.exe"
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Disable-ComputerRestore -Drive C:\\"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Enable-ComputerRestore -Drive C:\\"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /for=C: /all /quiet
Source: C:\Windows\System32\vssadmin.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Users\user\Desktop\zed.exe "C:\Users\user\Desktop\zed.exe"Jump to behavior
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Disable-ComputerRestore -Drive C:\\"Jump to behavior
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Enable-ComputerRestore -Drive C:\\"Jump to behavior
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /for=C: /all /quietJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: tcl86t.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: tk86t.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: zlib1.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\zed.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\vssadmin.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\vssadmin.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\vssadmin.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\vssadmin.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\vssadmin.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\vssadmin.exeSection loaded: vss_ps.dllJump to behavior
Source: C:\Windows\System32\vssadmin.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: zed.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: zed.exeStatic file information: File size 18960364 > 1048576
Source: zed.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: zed.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: zed.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: zed.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: zed.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: zed.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: zed.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: zed.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: zed.exe, 00000008.00000002.2554885693.00007FF820AF2000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: zed.exe, 00000006.00000003.1364209064.000001F951474000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: zed.exe, 00000008.00000002.2550907096.00007FF820191000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: cryptography_rust.pdbc source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: zed.exe, 00000008.00000002.2554191441.00007FF820684000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: zed.exe, 00000006.00000003.1280984486.000001F95144E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: zed.exe, 00000006.00000003.1279553215.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558993887.00007FF832813000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: zed.exe, 00000008.00000002.2550907096.00007FF8200F9000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: zed.exe, 00000006.00000003.1279553215.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558993887.00007FF832813000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: zed.exe, 00000008.00000002.2553699562.00007FF8205A8000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: zed.exe, 00000008.00000002.2550907096.00007FF820191000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: zed.exe, 00000006.00000003.1280902728.000001F95144E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: zed.exe, 00000006.00000003.1279716134.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558231566.00007FF8313D5000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: zed.exe, 00000008.00000002.2558859645.00007FF832163000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: zed.exe, 00000008.00000002.2558474117.00007FF8313F1000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: zed.exe, 00000006.00000003.1280623026.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2555889916.00007FF821467000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2557002717.00007FF821A5C000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: zed.exe, 00000006.00000003.1279821816.000001F95144E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: zed.exe, 00000008.00000002.2556332736.00007FF821A02000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: zed.exe, 00000006.00000003.1281084035.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2557820528.00007FF831333000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: zed.exe, 00000006.00000003.1280756006.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2557002717.00007FF821A5C000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: zed.exe, 00000006.00000003.1279938911.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558033578.00007FF83134E000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: zed.exe, 00000008.00000002.2558697196.00007FF8314A4000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: zed.exe, 00000006.00000003.1281181111.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2556855887.00007FF821A29000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: cryptography_rust.pdb source: zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: zed.exe, 00000008.00000002.2558697196.00007FF8314A4000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: zed.exe, 00000008.00000002.2543113259.00000185B0C70000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: zed.exe, 00000006.00000003.1279716134.000001F95144E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2558231566.00007FF8313D5000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdb source: zed.exe, 00000008.00000002.2554191441.00007FF820684000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: zed.exe, 00000008.00000002.2554472661.00007FF8206DD000.00000002.00000001.01000000.00000014.sdmp
Source: zed.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: zed.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: zed.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: zed.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: zed.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: VCRUNTIME140_1.dll.6.drStatic PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]
Source: zlib1.dll.6.drStatic PE information: section name: .xdata
Source: libcrypto-3.dll.6.drStatic PE information: section name: .00cfg
Source: libssl-3.dll.6.drStatic PE information: section name: .00cfg
Source: python312.dll.6.drStatic PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.6.drStatic PE information: section name: fothk
Source: VCRUNTIME140.dll.6.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F2B3F22 push rbx; ret 8_2_00007FF81F2B3F2A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FF7BED3238D push ecx; iretd 11_2_00007FF7BED323F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_00007FF7BED320DD push ecx; iretd 11_2_00007FF7BED323F2
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\tk86t.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\zlib1.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\tcl86t.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_tkinter.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_cffi_backend.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\charset_normalizer\md.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\charset_normalizer\md__mypyc.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\select.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\python312.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6475830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,6_2_00007FF6C6475830
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3889Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2285Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2952Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1889Jump to behavior
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_tkinter.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_cffi_backend.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\charset_normalizer\md.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\charset_normalizer\md__mypyc.cp312-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\select.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\python312.dllJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\zed.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_6-17250
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5980Thread sleep time: -5534023222112862s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6424Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5988Thread sleep time: -3689348814741908s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076Thread sleep time: -2767011611056431s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6479280 FindFirstFileExW,FindClose,6_2_00007FF6C6479280
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6491874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,6_2_00007FF6C6491874
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C64783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,6_2_00007FF6C64783C0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6479280 FindFirstFileExW,FindClose,8_2_00007FF6C6479280
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C6491874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,8_2_00007FF6C6491874
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C64783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,8_2_00007FF6C64783C0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79482\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Users\user\Desktop\zed.exeFile opened: C:\Users\user\Jump to behavior
Source: zed.exe, 00000008.00000002.2542620851.00000185B097D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00007FF6C647D12C
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6493480 GetProcessHeap,6_2_00007FF6C6493480
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00007FF6C647C8A0
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00007FF6C647D12C
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C648A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00007FF6C648A614
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647D30C SetUnhandledExceptionFilter,6_2_00007FF6C647D30C
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C647C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF6C647C8A0
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C647D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF6C647D12C
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C648A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF6C648A614
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF6C647D30C SetUnhandledExceptionFilter,8_2_00007FF6C647D30C
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F0F1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F0F1390
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F0F1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F0F1960
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F101960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F101960
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F101390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F101390
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F111390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F111390
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F111960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F111960
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F121390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F121390
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F121960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F121960
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F131390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F131390
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F131960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F131960
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F141390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F141390
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F141960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F141960
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F151390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F151390
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F151960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F151960
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F163028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00007FF81F163028
Source: C:\Users\user\Desktop\zed.exeCode function: 8_2_00007FF81F162A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00007FF81F162A70
Source: C:\Users\user\Desktop\zed.exeProcess created: C:\Users\user\Desktop\zed.exe "C:\Users\user\Desktop\zed.exe"Jump to behavior
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6499570 cpuid 6_2_00007FF6C6499570
Source: C:\Users\user\Desktop\zed.exeCode function: InitCommonControlsEx,RegisterClassW,GetKeyboardLayout,GetLocaleInfoW,TranslateCharsetInfo,8_2_00007FF81F466890
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\http1.0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\opt0.4 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\Desktop\zed.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79482\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C647D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,6_2_00007FF6C647D010
Source: C:\Users\user\Desktop\zed.exeCode function: 6_2_00007FF6C6495C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,6_2_00007FF6C6495C00

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		11
Process Injection		1
Masquerading		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		12
Encrypted Channel		Exfiltration Over Other Network Medium1
Data Encrypted for Impact
CredentialsDomainsDefault Accounts1
Native API		Boot or Logon Initialization Scripts1
DLL Side-Loading		21
Virtualization/Sandbox Evasion		LSASS Memory21
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
Process Injection		Security Account Manager1
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Deobfuscate/Decode Files or Information		NTDS21
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
Obfuscated Files or Information		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Timestomp		Cached Domain Credentials1
System Network Configuration Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading		DCSync2
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
File Deletion		Proc Filesystem32
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1566096 Sample: zed.exe Startdate: 01/12/2024 Architecture: WINDOWS Score: 68 46 api.ipify.org 2->46 50 Multi AV Scanner detection for submitted file 2->50 52 AI detected suspicious sample 2->52 54 Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities 2->54 9 zed.exe 1001 2->9         started        signatures3 process4 file5 30 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 9->30 dropped 32 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 9->32 dropped 34 C:\Users\user\AppData\Local\...\tk86t.dll, PE32+ 9->34 dropped 36 69 other files (none is malicious) 9->36 dropped 56 May disable shadow drive data (uses vssadmin) 9->56 58 Deletes shadow drive data (may be related to ransomware) 9->58 13 zed.exe 4 9->13         started        signatures6 process7 dnsIp8 48 api.ipify.org 172.67.74.152, 443, 49723 CLOUDFLARENETUS United States 13->48 38 C:\Users\user\Desktop\...\SUAVTZKNFL.jpg, ASCII 13->38 dropped 40 C:\Users\user\Desktop\QNCYCDFIJJ.docx, ASCII 13->40 dropped 42 C:\Users\user\DesktopWZCVGNOWT.mp3, ASCII 13->42 dropped 44 2 other malicious files 13->44 dropped 60 May disable shadow drive data (uses vssadmin) 13->60 62 Deletes shadow drive data (may be related to ransomware) 13->62 64 Modifies existing user documents (likely ransomware behavior) 13->64 18 powershell.exe 11 13->18         started        20 powershell.exe 11 13->20         started        22 vssadmin.exe 1 13->22         started        file9 signatures10 process11 process12 24 conhost.exe 18->24         started        26 conhost.exe 20->26         started        28 conhost.exe 22->28         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
zed.exe5%ReversingLabsWin64.Ransomware.Generic
zed.exe18%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_ARC4.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://usjjsjsj.com.ng/post_fenec_key_user.php?userID=0%Avira URL Cloudsafe
https://requests.readthedocs.ioEI794820%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
api.ipify.org
172.67.74.152
truefalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdfzed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://github.com/pyca/cryptography/issues/8996zed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmpfalse
        		high
        http://www.cert.fnmt.es/dpcs/-zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packageszed.exe, 00000008.00000002.2543404964.00000185B0FC0000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://setuptools.pypa.io/en/latest/zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#zed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://requests.readthedocs.ioEI79482zed.exe, 00000008.00000002.2544879514.00000185B2164000.00000004.00001000.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://tools.ietf.org/html/rfc2388#section-4.4zed.exe, 00000008.00000002.2543645311.00000185B151F000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://packaging.python.org/en/latest/specifications/core-metadata/zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64zed.exe, 00000008.00000002.2543215029.00000185B0DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/pypa/packagingzed.exe, 00000008.00000002.2543566402.00000185B11E0000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://refspecs.linuxfoundation.org/elf/gabi4zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://usjjsjsj.com.ng/post_fenec_key_user.php?userID=zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://nuget.org/nuget.exepowershell.exe, 0000000B.00000002.1482082942.000001C198F2E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1482082942.000001C199065000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              http://crl.dhimyotis.com/certignarootca.crlVzed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://tools.ietf.org/html/rfc3610zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/platformdirs/platformdirszed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://peps.python.org/pep-0205/zed.exe, 00000008.00000003.1369760102.00000185B0E29000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543404964.00000185B0FC0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      http://crl.dhimyotis.com/certignarootca.crlzed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://curl.haxx.se/rfc/cookie_spec.htmlzed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B134F000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://ocsp.accv.eszed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000B.00000002.1465650962.000001C188EB1000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;zed.exe, 00000008.00000003.1370601913.00000185B0EDF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0EF8000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370601913.00000185B0EB9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamezed.exe, 00000008.00000002.2542103956.00000185B0820000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyzed.exe, 00000008.00000002.2544759419.00000185B1C40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688zed.exe, 00000008.00000002.2542103956.00000185B0820000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://httpbin.org/getzed.exe, 00000008.00000002.2544759419.00000185B1C40000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0E68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://packaging.python.org/en/latest/specifications/entry-points/zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000E.00000002.1511110250.0000023030B62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-accesszed.exe, 00000008.00000003.1370601913.00000185B0EDF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0E98000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0EF8000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1374443659.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370706085.00000185B0DA9000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373471204.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370706085.00000185B0E71000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1371651313.00000185B0F21000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370887345.00000185B0E76000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://pypi.org/project/build/).zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000E.00000002.1511110250.0000023030B62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_codezed.exe, 00000008.00000003.1366205665.00000185B0970000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://wwww.certigna.fr/autorites/0mzed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerzed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://foo/bar.tgzzed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/python/cpython/issues/86361.zed.exe, 00000008.00000003.1371568605.00000185B0F43000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0DA0000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1371607532.00000185B0F2F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372050627.00000185B0F5A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://contoso.com/Iconpowershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://httpbin.org/zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://wwww.certigna.fr/autorites/zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-filezed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                    		high
                                                                                    https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gzzed.exe, 00000008.00000003.1373471204.00000185B0EBC000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372761146.00000185B13E3000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1372761146.00000185B138C000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373143309.00000185B13E6000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0E65000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0E68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_modulezed.exe, 00000008.00000002.2542977153.00000185B0B70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cacheszed.exe, 00000008.00000002.2542977153.00000185B0B70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.ietf.org/rfc/rfc3447.txtzed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://github.com/Pester/Pesterpowershell.exe, 0000000E.00000002.1511110250.0000023030B62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1511110250.0000023031D88000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1377574547.00000185B148A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-thezed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1377409408.00000185B1571000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1377574547.00000185B148A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B151F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syzed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://www.python.org/psf/license/zed.exe, 00000008.00000002.2555353226.00007FF820C68000.00000008.00000001.01000000.00000005.sdmpfalse
                                                                                                        		high
                                                                                                        https://docs.python.org/3/library/multiprocessing.htmlzed.exe, 00000008.00000003.1377108521.00000185B0F5E000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/pypa/setuptools/issues/417#issuecomment-392298401zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://crl.securetrust.com/STCA.crlzed.exe, 00000008.00000002.2544271136.00000185B16C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://wwwsearch.sf.net/):zed.exe, 00000008.00000002.2544189975.00000185B1656000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B134F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.accv.es/legislacion_c.htmzed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://tools.ietf.org/html/rfc6125#section-6.4.3zed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://www.zlib.net/Dzed.exe, 00000008.00000002.2553503567.00007FF820598000.00000008.00000001.01000000.0000001B.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://cffi.readthedocs.io/en/latest/using.html#callbackszed.exe, 00000008.00000002.2553915718.00007FF8205DC000.00000002.00000001.01000000.00000017.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://crl.xrampsecurity.com/XGCA.crl0zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://bugs.python.org/issue44497.zed.exe, 00000008.00000002.2544432815.00000185B1800000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://www.cert.fnmt.es/dpcs/zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://setuptools.pypa.io/en/latest/pkg_resources.htmlzed.exe, 00000008.00000003.1370601913.00000185B0EDF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1370933901.00000185B0EF8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://google.com/mailzed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://packaging.python.org/specifications/entry-points/zed.exe, 00000008.00000003.1377108521.00000185B0F4F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544514193.00000185B1930000.00000004.00001000.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376893151.00000185B135F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544593668.00000185B1A30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://github.com/jaraco/jaraco.functools/issues/5zed.exe, 00000008.00000003.1372835509.00000185B0F8A000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544352619.00000185B1700000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://www.accv.es00zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://www.python.org/psf/license/)zed.exe, 00000008.00000002.2554885693.00007FF820AF2000.00000002.00000001.01000000.00000005.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyzed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://www.rfc-editor.org/info/rfc7253zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/pyca/cryptography/issueszed.exe, 00000008.00000002.2549702058.00007FF81FB67000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdfzed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://tools.ietf.org/html/rfc8017#page-67zed.exe, 00000008.00000002.2545052666.00000185B21BF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://foss.heptapod.net/pypy/pypy/-/issues/3539zed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://google.com/zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://mahler:8092/site-updates.pyzed.exe, 00000008.00000003.1373057741.00000185B147A000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373143309.00000185B13E6000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376893151.00000185B13BD000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373663226.00000185B13CB000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://crl.securetrust.com/SGCA.crlzed.exe, 00000008.00000002.2544271136.00000185B16C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://.../back.jpegzed.exe, 00000008.00000002.2544879514.00000185B2090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://tools.ietf.org/html/rfc7231#section-4.3.6)zed.exe, 00000008.00000003.1373380848.00000185B143B000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373471204.00000185B0EBC000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1376728924.00000185B0E65000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0E68000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000003.1373471204.00000185B0E4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://tools.ietf.org/html/rfc5869zed.exe, 00000008.00000002.2545486870.00000185B2388000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B21E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.htmlzed.exe, 00000008.00000002.2543645311.00000185B1454000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2388000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545242522.00000185B21E9000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2545486870.00000185B2339000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://httpbin.org/postzed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsNzed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://contoso.com/Licensepowershell.exe, 0000000B.00000002.1465650962.000001C18A77C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourcezed.exe, 00000008.00000003.1366205665.00000185B0970000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://github.com/Ousret/charset_normalizerzed.exe, 00000008.00000002.2544189975.00000185B15E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://www.firmaprofesional.com/cps0zed.exe, 00000008.00000002.2545242522.00000185B2244000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_speczed.exe, 00000008.00000002.2542103956.00000185B089C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://github.com/urllib3/urllib3/issues/2920zed.exe, 00000008.00000002.2544759419.00000185B1C40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://tools.ietf.org/html/rfc8017zed.exe, 00000008.00000002.2545052666.00000185B21BF000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2546609856.00000185B2A80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://crl.securetrust.com/SGCA.crl0zed.exe, 00000008.00000002.2543645311.00000185B1454000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datazed.exe, 00000008.00000002.2542620851.00000185B0930000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://yahoo.com/zed.exe, 00000008.00000002.2543645311.00000185B155F000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543645311.00000185B13BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                http://crl.securetrust.com/STCA.crl0zed.exe, 00000008.00000002.2543645311.00000185B1454000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://api.ipify.orgzed.exe, 00000008.00000002.2544676981.00000185B1B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6zed.exe, 00000008.00000003.1376728924.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmp, zed.exe, 00000008.00000002.2543215029.00000185B0F0D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://html.spec.whatwg.org/multipage/zed.exe, 00000008.00000002.2544271136.00000185B1688000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high

                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                        172.67.74.152
                                                                                                                                                                                                        		api.ipify.orgUnited States
                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                        General Information

                                                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                        Analysis ID:1566096
                                                                                                                                                                                                        Start date and time:2024-12-01 10:38:10 +01:00
                                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                                        Overall analysis duration:0h 9m 35s
                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                        Number of analysed new started processes analysed:24
                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                                        Sample name:zed.exe
                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                        Classification:mal68.rans.evad.winEXE@12/1116@1/1
                                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                                        • Successful, ratio: 50%
                                                                                                                                                                                                        HCA Information:
                                                                                                                                                                                                        • Successful, ratio: 72%
                                                                                                                                                                                                        • Number of executed functions: 119
                                                                                                                                                                                                        • Number of non-executed functions: 160
                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, VSSVC.exe, svchost.exe
                                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                        • Execution Graph export aborted for target powershell.exe, PID 1424 because it is empty
                                                                                                                                                                                                        • Execution Graph export aborted for target powershell.exe, PID 2088 because it is empty
                                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                                        04:39:20API Interceptor13x Sleep call for process: powershell.exe modified

                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                        IPs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        172.67.74.1522b7cu0KwZl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        Zc9eO57fgF.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        67065b4c84713_Javiles.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        Yc9hcFC1ux.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        4F08j2Rmd9.binGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        y8tCHz7CwC.binGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        file.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                                                                                        • api.ipify.org/

                                                                                                                                                                                                        Domains

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        api.ipify.orgkyjjrfgjjsedf.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                        kohjaekdfth.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                        kthkksefd.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                        jhnykawfkth.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                        siveria.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                        weWHT1b7JO.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                        Employee_Secure_Doc.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                        unique.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                        siveria.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                        https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 104.26.12.205

                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        CLOUDFLARENETUSfile.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                        • 172.67.178.189
                                                                                                                                                                                                        sh4.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                        • 104.28.75.41
                                                                                                                                                                                                        gKWbina3a4.batGet hashmaliciousStealeriumBrowse
                                                                                                                                                                                                        • 104.16.184.241
                                                                                                                                                                                                        tnsoldfik82.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                        • 172.65.251.78
                                                                                                                                                                                                        tnksadfj28.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                        • 172.65.251.78
                                                                                                                                                                                                        Hnsajdkfjd28.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                                                                                                                                                        • 172.65.251.78
                                                                                                                                                                                                        file.exeGet hashmaliciousAmadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                        • 104.21.16.9
                                                                                                                                                                                                        file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                        • 104.21.16.9
                                                                                                                                                                                                        http://ueykjfltxqsb.spaceGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 104.21.19.45
                                                                                                                                                                                                        file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                        • 104.21.16.9

                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_Salsa20.pydfile.exeGet hashmaliciousPython Stealer, Amadey, LummaC Stealer, Nymaim, StealcBrowse
                                                                                                                                                                                                          file.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                            file.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                              file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, CryptbotBrowse
                                                                                                                                                                                                                  file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      Payload.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                        Payload.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                          Creal.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_ARC4.pydfile.exeGet hashmaliciousPython Stealer, Amadey, LummaC Stealer, Nymaim, StealcBrowse
                                                                                                                                                                                                                              file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, CryptbotBrowse
                                                                                                                                                                                                                                  file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      Payload.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                                        Payload.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                                          Creal.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                                                                            #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exeGet hashmaliciousBlank Grabber, Creal StealerBrowse
                                                                                                                                                                                                                                              https://t.ly/Oppenheim0511Get hashmaliciousGO BackdoorBrowse

                                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):64
                                                                                                                                                                                                                                                Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                                                                MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                                                                SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                                                                SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                                                                SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Reputation:high, very likely benign file
                                                                                                                                                                                                                                                Preview:@...e...........................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11264
                                                                                                                                                                                                                                                Entropy (8bit):4.640339306680604
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
                                                                                                                                                                                                                                                MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
                                                                                                                                                                                                                                                SHA1:EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
                                                                                                                                                                                                                                                SHA-256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
                                                                                                                                                                                                                                                SHA-512:8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Payload.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Payload.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Creal.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                                Entropy (8bit):5.0194545642425075
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
                                                                                                                                                                                                                                                MD5:F19CB847E567A31FAB97435536C7B783
                                                                                                                                                                                                                                                SHA1:4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
                                                                                                                                                                                                                                                SHA-256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
                                                                                                                                                                                                                                                SHA-512:382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Payload.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Payload.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Creal.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13312
                                                                                                                                                                                                                                                Entropy (8bit):5.037456384995606
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
                                                                                                                                                                                                                                                MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
                                                                                                                                                                                                                                                SHA1:A6FB87E8F3540743097A467ABE0723247FDAF469
                                                                                                                                                                                                                                                SHA-256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
                                                                                                                                                                                                                                                SHA-512:3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                                                Entropy (8bit):5.09191874780435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
                                                                                                                                                                                                                                                MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
                                                                                                                                                                                                                                                SHA1:46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
                                                                                                                                                                                                                                                SHA-256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
                                                                                                                                                                                                                                                SHA-512:691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):36352
                                                                                                                                                                                                                                                Entropy (8bit):6.541423493519083
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
                                                                                                                                                                                                                                                MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
                                                                                                                                                                                                                                                SHA1:7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
                                                                                                                                                                                                                                                SHA-256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
                                                                                                                                                                                                                                                SHA-512:11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):15360
                                                                                                                                                                                                                                                Entropy (8bit):5.367749645917753
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
                                                                                                                                                                                                                                                MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
                                                                                                                                                                                                                                                SHA1:0E41751AA48108D7924B0A70A86031DDE799D7D6
                                                                                                                                                                                                                                                SHA-256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
                                                                                                                                                                                                                                                SHA-512:E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):16384
                                                                                                                                                                                                                                                Entropy (8bit):5.41148259289073
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
                                                                                                                                                                                                                                                MD5:F14E1AA2590D621BE8C10321B2C43132
                                                                                                                                                                                                                                                SHA1:FD84D11619DFFDF82C563E45B48F82099D9E3130
                                                                                                                                                                                                                                                SHA-256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
                                                                                                                                                                                                                                                SHA-512:A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):20992
                                                                                                                                                                                                                                                Entropy (8bit):6.041302713678401
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
                                                                                                                                                                                                                                                MD5:B127CAE435AEB8A2A37D2A1BC1C27282
                                                                                                                                                                                                                                                SHA1:2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
                                                                                                                                                                                                                                                SHA-256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
                                                                                                                                                                                                                                                SHA-512:4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):24576
                                                                                                                                                                                                                                                Entropy (8bit):6.530656045206549
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
                                                                                                                                                                                                                                                MD5:2E15AA6F97ED618A3236CFA920988142
                                                                                                                                                                                                                                                SHA1:A9D556D54519D3E91FA19A936ED291A33C0D1141
                                                                                                                                                                                                                                                SHA-256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
                                                                                                                                                                                                                                                SHA-512:A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                                Entropy (8bit):4.7080156150187396
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
                                                                                                                                                                                                                                                MD5:40390F2113DC2A9D6CFAE7127F6BA329
                                                                                                                                                                                                                                                SHA1:9C886C33A20B3F76B37AA9B10A6954F3C8981772
                                                                                                                                                                                                                                                SHA-256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
                                                                                                                                                                                                                                                SHA-512:617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12800
                                                                                                                                                                                                                                                Entropy (8bit):5.159963979391524
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
                                                                                                                                                                                                                                                MD5:899895C0ED6830C4C9A3328CC7DF95B6
                                                                                                                                                                                                                                                SHA1:C02F14EBDA8B631195068266BA20E03210ABEABC
                                                                                                                                                                                                                                                SHA-256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
                                                                                                                                                                                                                                                SHA-512:0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                                                Entropy (8bit):5.270418334522813
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
                                                                                                                                                                                                                                                MD5:C4C525B081F8A0927091178F5F2EE103
                                                                                                                                                                                                                                                SHA1:A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
                                                                                                                                                                                                                                                SHA-256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
                                                                                                                                                                                                                                                SHA-512:7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):56832
                                                                                                                                                                                                                                                Entropy (8bit):4.231032526864278
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
                                                                                                                                                                                                                                                MD5:F9E266F763175B8F6FD4154275F8E2F0
                                                                                                                                                                                                                                                SHA1:8BE457700D58356BC2FA7390940611709A0E5473
                                                                                                                                                                                                                                                SHA-256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
                                                                                                                                                                                                                                                SHA-512:EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):57344
                                                                                                                                                                                                                                                Entropy (8bit):4.252429732285762
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
                                                                                                                                                                                                                                                MD5:DECF524B2D53FCD7D4FA726F00B3E5FC
                                                                                                                                                                                                                                                SHA1:E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
                                                                                                                                                                                                                                                SHA-256:58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
                                                                                                                                                                                                                                                SHA-512:EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                                Entropy (8bit):4.690163963718492
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
                                                                                                                                                                                                                                                MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
                                                                                                                                                                                                                                                SHA1:B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
                                                                                                                                                                                                                                                SHA-256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
                                                                                                                                                                                                                                                SHA-512:2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):22016
                                                                                                                                                                                                                                                Entropy (8bit):6.1215844022564285
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
                                                                                                                                                                                                                                                MD5:3727271FE04ECB6D5E49E936095E95BC
                                                                                                                                                                                                                                                SHA1:46182698689A849A8C210A8BF571D5F574C6F5B1
                                                                                                                                                                                                                                                SHA-256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
                                                                                                                                                                                                                                                SHA-512:5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):17920
                                                                                                                                                                                                                                                Entropy (8bit):5.293810509074883
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
                                                                                                                                                                                                                                                MD5:78AEF441C9152A17DD4DC40C7CC9DF69
                                                                                                                                                                                                                                                SHA1:6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
                                                                                                                                                                                                                                                SHA-256:56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
                                                                                                                                                                                                                                                SHA-512:27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11776
                                                                                                                                                                                                                                                Entropy (8bit):4.862619033406922
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
                                                                                                                                                                                                                                                MD5:19E0ABF76B274C12FF624A16713F4999
                                                                                                                                                                                                                                                SHA1:A4B370F556B925F7126BF87F70263D1705C3A0DB
                                                                                                                                                                                                                                                SHA-256:D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
                                                                                                                                                                                                                                                SHA-512:D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                                                Entropy (8bit):5.227045547076371
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
                                                                                                                                                                                                                                                MD5:309D6F6B0DD022EBD9214F445CAC7BB9
                                                                                                                                                                                                                                                SHA1:ABD22690B7AD77782CFC0D2393D0C038E16070B0
                                                                                                                                                                                                                                                SHA-256:4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
                                                                                                                                                                                                                                                SHA-512:D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                                Entropy (8bit):5.176369829782773
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
                                                                                                                                                                                                                                                MD5:D54FEB9A270B212B0CCB1937C660678A
                                                                                                                                                                                                                                                SHA1:224259E5B684C7AC8D79464E51503D302390C5C9
                                                                                                                                                                                                                                                SHA-256:032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
                                                                                                                                                                                                                                                SHA-512:29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):14336
                                                                                                                                                                                                                                                Entropy (8bit):5.047563322651927
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
                                                                                                                                                                                                                                                MD5:52DCD4151A9177CF685BE4DF48EA9606
                                                                                                                                                                                                                                                SHA1:F444A4A5CBAE9422B408420115F0D3FF973C9705
                                                                                                                                                                                                                                                SHA-256:D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
                                                                                                                                                                                                                                                SHA-512:64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                                Entropy (8bit):5.09893680790018
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
                                                                                                                                                                                                                                                MD5:F929B1A3997427191E07CF52AC883054
                                                                                                                                                                                                                                                SHA1:C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
                                                                                                                                                                                                                                                SHA-256:5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
                                                                                                                                                                                                                                                SHA-512:2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):15360
                                                                                                                                                                                                                                                Entropy (8bit):5.451865349855574
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
                                                                                                                                                                                                                                                MD5:1FA5E257A85D16E916E9C22984412871
                                                                                                                                                                                                                                                SHA1:1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
                                                                                                                                                                                                                                                SHA-256:D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
                                                                                                                                                                                                                                                SHA-512:E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13824
                                                                                                                                                                                                                                                Entropy (8bit):5.104245335186531
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
                                                                                                                                                                                                                                                MD5:FAD578A026F280C1AE6F787B1FA30129
                                                                                                                                                                                                                                                SHA1:9A3E93818A104314E172A304C3D117B6A66BEB55
                                                                                                                                                                                                                                                SHA-256:74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
                                                                                                                                                                                                                                                SHA-512:ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):17920
                                                                                                                                                                                                                                                Entropy (8bit):5.671305741258107
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
                                                                                                                                                                                                                                                MD5:556E6D0E5F8E4DA74C2780481105D543
                                                                                                                                                                                                                                                SHA1:7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
                                                                                                                                                                                                                                                SHA-256:247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
                                                                                                                                                                                                                                                SHA-512:28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....*..........P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):21504
                                                                                                                                                                                                                                                Entropy (8bit):5.878701941774916
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
                                                                                                                                                                                                                                                MD5:2F2655A7BBFE08D43013EDDA27E77904
                                                                                                                                                                                                                                                SHA1:33D51B6C423E094BE3E34E5621E175329A0C0914
                                                                                                                                                                                                                                                SHA-256:C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
                                                                                                                                                                                                                                                SHA-512:8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):21504
                                                                                                                                                                                                                                                Entropy (8bit):5.881781476285865
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
                                                                                                                                                                                                                                                MD5:CDE035B8AB3D046B1CE37EEE7EE91FA0
                                                                                                                                                                                                                                                SHA1:4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
                                                                                                                                                                                                                                                SHA-256:16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
                                                                                                                                                                                                                                                SHA-512:C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):26624
                                                                                                                                                                                                                                                Entropy (8bit):5.837887867708438
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
                                                                                                                                                                                                                                                MD5:999D431197D7E06A30E0810F1F910B9A
                                                                                                                                                                                                                                                SHA1:9BFF781221BCFFD8E55485A08627EC2A37363C96
                                                                                                                                                                                                                                                SHA-256:AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
                                                                                                                                                                                                                                                SHA-512:A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):26624
                                                                                                                                                                                                                                                Entropy (8bit):5.895310340516013
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
                                                                                                                                                                                                                                                MD5:0931ABBF3AED459B1A2138B551B1D3BB
                                                                                                                                                                                                                                                SHA1:9EC0296DDAF574A89766A2EC035FC30073863AB0
                                                                                                                                                                                                                                                SHA-256:1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
                                                                                                                                                                                                                                                SHA-512:9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12800
                                                                                                                                                                                                                                                Entropy (8bit):4.967737129255606
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
                                                                                                                                                                                                                                                MD5:5F057A380BACBA4EF59C0611549C0E02
                                                                                                                                                                                                                                                SHA1:4B758D18372D71F0AA38075F073722A55B897F71
                                                                                                                                                                                                                                                SHA-256:BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
                                                                                                                                                                                                                                                SHA-512:E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13312
                                                                                                                                                                                                                                                Entropy (8bit):5.007867576025166
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
                                                                                                                                                                                                                                                MD5:49BCA1B7DF076D1A550EE1B7ED3BD997
                                                                                                                                                                                                                                                SHA1:47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
                                                                                                                                                                                                                                                SHA-256:49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
                                                                                                                                                                                                                                                SHA-512:8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):15872
                                                                                                                                                                                                                                                Entropy (8bit):5.226023387740053
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
                                                                                                                                                                                                                                                MD5:CB5CFDD4241060E99118DEEC6C931CCC
                                                                                                                                                                                                                                                SHA1:1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
                                                                                                                                                                                                                                                SHA-256:A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
                                                                                                                                                                                                                                                SHA-512:8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):14848
                                                                                                                                                                                                                                                Entropy (8bit):5.262055670423592
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
                                                                                                                                                                                                                                                MD5:18D2D96980802189B23893820714DA90
                                                                                                                                                                                                                                                SHA1:5DEE494D25EB79038CBC2803163E2EF69E68274C
                                                                                                                                                                                                                                                SHA-256:C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
                                                                                                                                                                                                                                                SHA-512:0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):36352
                                                                                                                                                                                                                                                Entropy (8bit):5.913843738203007
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
                                                                                                                                                                                                                                                MD5:EF472BA63FD22922CA704B1E7B95A29E
                                                                                                                                                                                                                                                SHA1:700B68E7EF95514D5E94D3C6B10884E1E187ACD8
                                                                                                                                                                                                                                                SHA-256:66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
                                                                                                                                                                                                                                                SHA-512:DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                                Entropy (8bit):4.735350805948923
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
                                                                                                                                                                                                                                                MD5:3B1CE70B0193B02C437678F13A335932
                                                                                                                                                                                                                                                SHA1:063BFD5A32441ED883409AAD17285CE405977D1F
                                                                                                                                                                                                                                                SHA-256:EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
                                                                                                                                                                                                                                                SHA-512:0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):22528
                                                                                                                                                                                                                                                Entropy (8bit):5.705606408072877
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
                                                                                                                                                                                                                                                MD5:FF33C306434DEC51D39C7BF1663E25DA
                                                                                                                                                                                                                                                SHA1:665FCF47501F1481534597C1EAC2A52886EF0526
                                                                                                                                                                                                                                                SHA-256:D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
                                                                                                                                                                                                                                                SHA-512:66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):70656
                                                                                                                                                                                                                                                Entropy (8bit):6.0189903352673655
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
                                                                                                                                                                                                                                                MD5:F267BF4256F4105DAD0D3E59023011ED
                                                                                                                                                                                                                                                SHA1:9BC6CA0F375CE49D5787C909D290C07302F58DA6
                                                                                                                                                                                                                                                SHA-256:1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
                                                                                                                                                                                                                                                SHA-512:A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):770560
                                                                                                                                                                                                                                                Entropy (8bit):7.613224993327352
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
                                                                                                                                                                                                                                                MD5:1EFD7F7CB1C277416011DE6F09C355AF
                                                                                                                                                                                                                                                SHA1:C0F97652AC2703C325AB9F20826A6F84C63532F2
                                                                                                                                                                                                                                                SHA-256:AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
                                                                                                                                                                                                                                                SHA-512:2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):26112
                                                                                                                                                                                                                                                Entropy (8bit):5.8551858881598795
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
                                                                                                                                                                                                                                                MD5:C5FB377F736ED731B5578F57BB765F7A
                                                                                                                                                                                                                                                SHA1:5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
                                                                                                                                                                                                                                                SHA-256:32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
                                                                                                                                                                                                                                                SHA-512:D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):84992
                                                                                                                                                                                                                                                Entropy (8bit):6.064677498000638
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
                                                                                                                                                                                                                                                MD5:8A0C0AA820E98E83AC9B665A9FD19EAF
                                                                                                                                                                                                                                                SHA1:6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
                                                                                                                                                                                                                                                SHA-256:4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
                                                                                                                                                                                                                                                SHA-512:52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                                Entropy (8bit):4.675380950473425
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
                                                                                                                                                                                                                                                MD5:44B930B89CE905DB4716A548C3DB8DEE
                                                                                                                                                                                                                                                SHA1:948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
                                                                                                                                                                                                                                                SHA-256:921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
                                                                                                                                                                                                                                                SHA-512:79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                                Entropy (8bit):4.625428549874022
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
                                                                                                                                                                                                                                                MD5:F24F9356A6BDD29B9EF67509A8BC3A96
                                                                                                                                                                                                                                                SHA1:A26946E938304B4E993872C6721EB8CC1DCBE43B
                                                                                                                                                                                                                                                SHA-256:034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
                                                                                                                                                                                                                                                SHA-512:C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\VCRUNTIME140.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):119192
                                                                                                                                                                                                                                                Entropy (8bit):6.6016214745004635
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
                                                                                                                                                                                                                                                MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
                                                                                                                                                                                                                                                SHA1:A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
                                                                                                                                                                                                                                                SHA-256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
                                                                                                                                                                                                                                                SHA-512:0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):49528
                                                                                                                                                                                                                                                Entropy (8bit):6.662491747506177
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
                                                                                                                                                                                                                                                MD5:F8DFA78045620CF8A732E67D1B1EB53D
                                                                                                                                                                                                                                                SHA1:FF9A604D8C99405BFDBBF4295825D3FCBC792704
                                                                                                                                                                                                                                                SHA-256:A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
                                                                                                                                                                                                                                                SHA-512:BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...|!..{.&.|!..{...|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_asyncio.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):71448
                                                                                                                                                                                                                                                Entropy (8bit):6.263206909105092
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:BoxWhy9EQkTpR1Pg9qgTILN/86wW1lI1Onl7SyPxN3:BiWhy3k1Ra9qgTILN/Lw8lI1OnlB
                                                                                                                                                                                                                                                MD5:CC0F232F2A8A359DEE29A573667E6D77
                                                                                                                                                                                                                                                SHA1:D3FFBF5606D9C77A0DE0B7456F7A5314F420B1F7
                                                                                                                                                                                                                                                SHA-256:7A5C88CE496BAFDF31A94AE6D70B017070703BC0A7DA1DFAE7C12B21BB61030D
                                                                                                                                                                                                                                                SHA-512:48484177BF55179607D66F5A5837A35CD586E8A9FB185DE8B10865AAB650B056A61D1DC96370C5EFC6955CCB4E34B31810F8E1C8F5F02D268F565A73B4FF5657
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7_[.V1..V1..V1......V1.5.0..V1.5.2..V1.5.5..V1.5.4..V1...0..V1...0..V1..V0.qV1...<..V1...1..V1......V1...3..V1.Rich.V1.........................PE..d.....f.........." ...(.f................................................... ............`.............................................P......d......................../..............T...........................@...@............................................text...]e.......f.................. ..`.rdata..pO.......P...j..............@..@.data...p...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_bz2.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):85272
                                                                                                                                                                                                                                                Entropy (8bit):6.591457260071925
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:+yhz79151BVo1vXfzIFnaR4bO1AsCn8Bsjk+tI1CVQ7Sy4x+R:Nhzx15evXkuxAB8BMk+tI1CVQF
                                                                                                                                                                                                                                                MD5:DD26ED92888DE9C57660A7AD631BB916
                                                                                                                                                                                                                                                SHA1:77D479D44D9E04F0A1355569332233459B69A154
                                                                                                                                                                                                                                                SHA-256:324268786921EC940CBD4B5E2F71DAFD08E578A12E373A715658527E5B211697
                                                                                                                                                                                                                                                SHA-512:D693367565005C1B87823E781DC5925146512182C8D8A3A2201E712C88DF1C0E66E65ECAEC9AF22037F0A8F8B3FB3F511EA47CFD5774651D71673FAB612D2897
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d......f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_cffi_backend.cp312-win_amd64.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179712
                                                                                                                                                                                                                                                Entropy (8bit):6.180800197956408
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:IULjhBCx8qImKrUltSfGzdMcbb9CF8OS7jkSTLkKWlgeml:IgCeqImzSfIMcNCvOkSTLLWWem
                                                                                                                                                                                                                                                MD5:FCB71CE882F99EC085D5875E1228BDC1
                                                                                                                                                                                                                                                SHA1:763D9AFA909C15FEA8E016D321F32856EC722094
                                                                                                                                                                                                                                                SHA-256:86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
                                                                                                                                                                                                                                                SHA-512:4A0E98AB450453FD930EDC04F0F30976ABB9214B693DB4B6742D784247FB062C57FAFAFB51EB04B7B4230039AB3B07D2FFD3454D6E261811F34749F2E35F04D6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...).....B......`........................................0............`..........................................h..l....i..................T............ .......O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...p..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_ctypes.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):125208
                                                                                                                                                                                                                                                Entropy (8bit):6.138116508461042
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:cXw32spTVYgFoj6N2xE9sb7VRf/EiZBq5syCtYPU9BI1LP885:cgGEOgFoj68ksrf/Ejsa5
                                                                                                                                                                                                                                                MD5:C8AFA1EBB28828E1115C110313D2A810
                                                                                                                                                                                                                                                SHA1:1D0D28799A5DBE313B6F4DDFDB7986D2902FA97A
                                                                                                                                                                                                                                                SHA-256:8978972CF341CCD0EDF8435D63909A739DF7EF29EC7DD57ED5CAB64B342891F0
                                                                                                                                                                                                                                                SHA-512:4D9F41BD23B62600D1EB097D1578BA656B5E13FD2F31EF74202AA511111969BB8CFC2A8E903DE73BD6E63FADAA59B078714885B8C5B8ECC5C4128FF9D06C1E56
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......f.d."..."..."...+...$....... .......&.......*...........7... ...i...#...i...$.......!..."......7...$...7...#...7...#...7...#...Rich"...........................PE..d....f.........." ...(............`_..............................................|.....`.........................................p`.......`.........................../......t.......T...............................@............................................text............................... ..`.rdata..hl.......n..................@..@.data...,5.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_decimal.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257304
                                                                                                                                                                                                                                                Entropy (8bit):6.565090204799859
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:3uQjqbJrTwvqM+eYx+lDJOAkl9qWM53pLW1AcfRRR6tlISgOg:3sTwvWeS+xJw4ln7g
                                                                                                                                                                                                                                                MD5:CEA3B419C7CA87140A157629C6DBD299
                                                                                                                                                                                                                                                SHA1:7DBFF775235B1937B150AE70302B3208833DC9BE
                                                                                                                                                                                                                                                SHA-256:95B9850E6FB335B235589DD1348E007507C6B28E332C9ABB111F2A0035C358E5
                                                                                                                                                                                                                                                SHA-512:6E3A6781C0F05BB5182073CCA1E69B6DF55F05FF7CDCEA394BACF50F88605E2241B7387F1D8BA9F40A96832D04F55EDB80003F0CF1E537A26F99408EE9312F5B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d.....f.........." ...(.....<............................................................`..........................................c..P....c...................&......./......T.......T...........................p...@............................................text...9........................... ..`.rdata..(...........................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_hashlib.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):66328
                                                                                                                                                                                                                                                Entropy (8bit):6.227566291152438
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:/9gLpgE4Z27ARZWZnEmoAlI1OIH7SyT0xq:26RZeEmoAlI1OIHth
                                                                                                                                                                                                                                                MD5:D19CB5CA144AE1FD29B6395B0225CF40
                                                                                                                                                                                                                                                SHA1:5B9EC6E656261CE179DFCFD5C6A3CFE07C2DFEB4
                                                                                                                                                                                                                                                SHA-256:F95EC2562A3C70FB1A6E44D72F4223CE3C7A0F0038159D09DCE629F59591D5AA
                                                                                                                                                                                                                                                SHA-512:9AC3A8A4DBDB09BE3760E7CCB11269F82A47B24C03D10D289BCDDED9A43E57D3CD656F8D060D66B810382ECAC3A62F101F83EA626B58CD0B5A3CCA25B67B1519
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N@.. ... ... ...... ..k!... ..k#... ..k$... ..k%... ..l!... ...!... ..h!... ...!.Y. ..l-... ..l ... ..l.... ..l"... .Rich.. .........................PE..d......f.........." ...(.V.......... @............................................../.....`.........................................p...P................................/......X...@}..T............................|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_lzma.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):160024
                                                                                                                                                                                                                                                Entropy (8bit):6.85368707809341
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:lsvkxujgo7e2uONOG+hi+C8znfF9mNooXnmbutI1Z1mb:lnu0o7JUrNYOo2Kz
                                                                                                                                                                                                                                                MD5:8CFBAFE65D6E38DDE8E2E8006B66BB3E
                                                                                                                                                                                                                                                SHA1:CB63ADDD102E47C777D55753C00C29C547E2243C
                                                                                                                                                                                                                                                SHA-256:6D548DB0AB73291F82CF0F4CA9EC0C81460185319C8965E829FAEACAE19444FF
                                                                                                                                                                                                                                                SHA-512:FA021615D5C080AADCD5B84FD221900054EB763A7AF8638F70CF6CD49BD92773074F1AC6884F3CE1D8A15D59439F554381377FAEE4842ED5BEB13FF3E1B510F4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d......f.........." ...(.f..........`8....................................................`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_multiprocessing.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):35608
                                                                                                                                                                                                                                                Entropy (8bit):6.432025225087344
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:a1Rp7eiajKCWnAxQ0zduVI1Wt95YiSyvAAMxkE3:mRteiaoAxQ0zIVI1Wtj7SyGxr
                                                                                                                                                                                                                                                MD5:EB859FC7F54CBA118A321440AD088096
                                                                                                                                                                                                                                                SHA1:9D3C410240F4C5269E07FFBDE43D6F5E7CC30B44
                                                                                                                                                                                                                                                SHA-256:14BDD15D60B9D6141009AEEDC606007C42B46C779A523D21758E57CF126DC2A4
                                                                                                                                                                                                                                                SHA-512:694A9C1CC3DC78B47FAEDF66248FF078E5090CFAB22E95C123FB99B10192A5748748A5F0937FFD9FD8E1873AD48F290BE723FE194B7EB2A731ADD7F5FB776C4A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.A)../z../z../z..z../z.$.{../z.$,{../z.$+{../z.$*{../z.#.{../z...zr./z[..{../z.#"{../z.#/{../z.#.z../z.#-{../zRich../z........PE..d.....f.........." ...(. ...>......@................................................J....`.........................................@E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata... ...0..."...$..............@..@.data...`....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_overlapped.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):56088
                                                                                                                                                                                                                                                Entropy (8bit):6.331247108655531
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:Minr44gaZPXxCJ/+yZdDDr5I1Xtw7Sy+xmS2:M3J/+yZdDDr5I1Xtwf
                                                                                                                                                                                                                                                MD5:DF92EA698A3D0729B70A4306BBE3029F
                                                                                                                                                                                                                                                SHA1:B82F3A43568148C64A46E2774AEC39BF1F2D3C1E
                                                                                                                                                                                                                                                SHA-256:46DEC978EC8CB2146854739BFEDDEA93335DCC92A25D719352B94F9517855032
                                                                                                                                                                                                                                                SHA-512:BDEBAFE1B40244A0CB6C97E75424F79CFE395774A9D03CDB02F82083110C1F4BDCAC2819BA1845AD1C56E2D2E6506DCC1833E4EB269BB0F620F0EB73B4D47817
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.{X..(X..(X..(QxT(\..(...)Z..(...)[..(...)P..(...)T..(M..)Z..(X..(/..(.x.)]..(.x.)Y..(M..)Y..(M..)Y..(M.8(Y..(M..)Y..(RichX..(........PE..d.....f.........." ...(.N...`.......................................................M....`.............................................X.............................../......(....f..T............................e..@............`...............................text...7L.......N.................. ..`.rdata...8...`...:...R..............@..@.data...0...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_queue.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):32536
                                                                                                                                                                                                                                                Entropy (8bit):6.552970921547832
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:1lzRmezd6rGjMoW4BI1QUGL5YiSyv8+WAMxkEW7:LRm0MGooW4BI1QUG17SyIxC7
                                                                                                                                                                                                                                                MD5:7D91DD8E5F1DBC3058EA399F5F31C1E6
                                                                                                                                                                                                                                                SHA1:B983653B9F2DF66E721ECE95F086C2F933D303FC
                                                                                                                                                                                                                                                SHA-256:76BBA42B1392DC57A867AEF385B990FA302A4F1DCF453705AC119C9C98A36E8D
                                                                                                                                                                                                                                                SHA-512:B8E7369DA79255A4BB2ED91BA0C313B4578EE45C94E6BC74582FC14F8B2984ED8FCDA0434A5BD3B72EA704E6E8FD8CBF1901F325E774475E4F28961483D6C7CF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.\.V...V...V...."..V..5...V..5...V..5...V..5...V......V.......V...V...V......V......V....N..V......V..Rich.V..........................PE..d.....f.........." ...(.....8.......................................................x....`..........................................C..L...<D..d....p.......`.......P.../...........4..T...........................@3..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_socket.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):83736
                                                                                                                                                                                                                                                Entropy (8bit):6.31969940395018
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:COYhekrkJqlerLSyypHi9/s+S+pzjii/n1IsJqKNBI1Lw9PD7Sy9duxJ:jwkJqHyypHi9/sT+pzjiE1IwdNBI1LwU
                                                                                                                                                                                                                                                MD5:E43AED7D6A8BCD9DDFC59C2D1A2C4B02
                                                                                                                                                                                                                                                SHA1:36F367F68FB9868412246725B604B27B5019D747
                                                                                                                                                                                                                                                SHA-256:2C2A6A6BA360E38F0C2B5A53B4626F833A3111844D95615EBF35BE0E76B1EF7A
                                                                                                                                                                                                                                                SHA-512:D92E26EB88DB891DE389A464F850A8DA0A39AF8A4D86D9894768CB97182B8351817CE14FE1EB8301B18B80D1D5D8876A48BA66EB7B874C7C3D7B009FCDBC8C4E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c|.Nb}g.a|.Nb}g.f|.Nb}g.g|.Nb}..c|.Nb}.Nc}.Nb}.6c|.Nb}..o|.Nb}..b|.Nb}..}.Nb}..`|.Nb}Rich.Nb}................PE..d......f.........." ...(.x..........0-.......................................`......@.....`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_ssl.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178456
                                                                                                                                                                                                                                                Entropy (8bit):5.974570300962832
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:ZmkiCZfBmvD1ZLnM2Yfp6XSVJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JtI1C7lD:xiC5QD1dwp6XSxMfjTwJxd
                                                                                                                                                                                                                                                MD5:6A2B0F8F50B47D05F96DEFF7883C1270
                                                                                                                                                                                                                                                SHA1:2B1AEB6FE9A12E0D527B042512FC8890EEDB10D8
                                                                                                                                                                                                                                                SHA-256:68DAD60FF6FB36C88EF1C47D1855517BFE8DE0F5DDEA0F630B65B622A645D53A
                                                                                                                                                                                                                                                SHA-512:A080190D4E7E1ABB186776AE6E83DAB4B21A77093A88FCA59CE1F63C683F549A28D094818A0EE44186DDEA2095111F1879008C0D631FC4A8D69DD596EF76CA37
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^..`...`...`......`./ia...`./ic...`./id...`./ie...`..na...`..ja...`...a.u.`...a...`..nm...`..n`...`..n....`..nb...`.Rich..`.........PE..d......f.........." ...(.............,....................................................`.............................................d...D...................P......../......x.......T...........................@...@............................................text............................... ..`.rdata...#.......$..................@..@.data...p...........................@....pdata..P............b..............@..@.rsrc................n..............@..@.reloc..x............x..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\auto.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):21523
                                                                                                                                                                                                                                                Entropy (8bit):4.827830596623684
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
                                                                                                                                                                                                                                                MD5:08EDF746B4A088CB4185C165177BD604
                                                                                                                                                                                                                                                SHA1:395CDA114F23E513EEF4618DA39BB86D034124BF
                                                                                                                                                                                                                                                SHA-256:517204EE436D08EFC287ABC97433C3BFFCAF42EC6592A3009B9FD3B985AD772C
                                                                                                                                                                                                                                                SHA-512:C1727E265A6B0B54773C886A1BCE73512E799BA81A4FCEEEB84CDC33F5505A5E0984E96326A78C46BF142BC4652A80E213886F60EB54ADF92E4DFFE953C87F6B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# auto.tcl --..#..# utility procs formerly in init.tcl dealing with auto execution of commands..# and can be auto loaded themselves...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# auto_reset --..#..# Destroy all cached information for auto-loading and auto-execution, so that..# the information gets recomputed the next time it's needed. Also delete any..# commands that are listed in the auto-load index...#..# Arguments:..# None.....proc auto_reset {} {.. global auto_execs auto_index auto_path.. if {[array exists auto_index]} {...foreach cmdName [array names auto_index] {... set fqcn [namespace which $cmdName]... if {$fqcn eq ""} {....continue... }... rename $fqcn {}...}.. }.. unset -nocomplain auto_execs auto_index ::tcl::auto_oldpath.. if {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\clock.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):133439
                                                                                                                                                                                                                                                Entropy (8bit):5.044814789288095
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:Cbn4IAhYvuCg9epsArAzqpSMpWzP7ejMiIAxBPqGYkPAPaZpHYM8EN4LhVLlarXL:Cbn4IM9epsArSqpSMpWzP7ejM/eBPqG3
                                                                                                                                                                                                                                                MD5:88BB44A1364147FDD80F9FD78FBCEF61
                                                                                                                                                                                                                                                SHA1:2C3454D2669F0CA83FECF17976D599C85B86E615
                                                                                                                                                                                                                                                SHA-256:1947F8B188AB4AB6AA72EA68A58D2D9ADD0894FDF320F6B074EAE0F198368FB7
                                                                                                                                                                                                                                                SHA-512:010B13E8A2D50521B5D7ADCC5F32F7CDE3F12E1053961C575D967DC6CFD368640BF45D23832E5E9C3868CDCA9FE0505698F949C5557D4169353634C94AA196B5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#----------------------------------------------------------------------..#..# clock.tcl --..#..#.This file implements the portions of the [clock] ensemble that are..#.coded in Tcl. Refer to the users' manual to see the description of..#.the [clock] command and its subcommands...#..#..#----------------------------------------------------------------------..#..# Copyright (c) 2004-2007 Kevin B. Kenny..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#..#----------------------------------------------------------------------....# We must have message catalogs that support the root locale, and we need..# access to the Registry on Windows systems.....uplevel \#0 {.. package require msgcat 1.6.. if { $::tcl_platform(platform) eq {windows} } {...if { [catch { package require registry 1.1 }] } {... namespace eval ::tcl::clock [list variable NoRegistry {}]...}.. }..}....# Put the library directory in

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\ascii.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):2.1033474959326957
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:5c2VBUvEWVrVJ/eyN9j2iV2NdWWT0VbusV7EV7KVAMmVZyd851VFpsGkliX:5HVBUlJvRj7SOVbusZhAMiZyi77qsX
                                                                                                                                                                                                                                                MD5:9E3A454FA480E9A99D2D5ACDAA775233
                                                                                                                                                                                                                                                SHA1:493637BB570A5C96BB62F998BD0391FB59AFC5F0
                                                                                                                                                                                                                                                SHA-256:FB87BF197F4F485B08EA81F7534BC07D9C3A538D022424BE11011A1FE3C413FD
                                                                                                                                                                                                                                                SHA-512:EDFCB2BB6AB052D28D5CEBD08AD57F36D3A4CB83D557B1359B0ADE1266E24D8F3CE87B8240881396A5BA4FB45F8B74014784E8885CDB86680D98977CC0D130F0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: ascii, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\big5.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):94389
                                                                                                                                                                                                                                                Entropy (8bit):3.3217406555698195
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:UAHU3LIkZlmXrd/uQ0ao98zgKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fd:UVduBGf94gFMT6q95GDRBfd
                                                                                                                                                                                                                                                MD5:41A874778111CC218BD421CF9C795EC2
                                                                                                                                                                                                                                                SHA1:80857D106F71199CE187833D38DB091A819A520C
                                                                                                                                                                                                                                                SHA-256:AD1ED201B69855BFD353BF969DFC55576DA35A963ABF1BF7FC6D8B5142A61A61
                                                                                                                                                                                                                                                SHA-512:4244624124F86A3EFAB4C70B115A46C8ADF02D708860FA5F327CDBFA24BC3F9EFAD0C6EE58DE96B0B6BBC4CF6D99B322BB8657129007C86D6482F41C1503AAD4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: big5, multi-byte..M..003F 0 89..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cns11643.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):98634
                                                                                                                                                                                                                                                Entropy (8bit):2.438904802083714
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:MPFOsOKqBLPf62X4lgQeLHj6RHUn0TQb8G47Ianrd28gr:MPAsknjX4OQe7aoMMarAFr
                                                                                                                                                                                                                                                MD5:B6A7C59E6A48D91CC2DBCB2BBA7E4510
                                                                                                                                                                                                                                                SHA1:16A9338F18202B26981F2028BEA412DD03BB0FF2
                                                                                                                                                                                                                                                SHA-256:8924545CC92584169138AADB64683C07BBF846A57014C2E668D23B63F43F3610
                                                                                                                                                                                                                                                SHA-512:3D644CF394A528A8699BE3679F787A4E1DAD657C04B810580A4C520F2C043471640FBE080AC46DFD3924C47A73BEE12A6AC69D291D09EB791AD0D64A73750B43
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cns11643, double-byte..D..2134 0 93..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00004E284E364E3F4E854E054E04518251965338536953B64E2A4E874E4951E2..4E464E8F4EBC4EBE516651E35204529C53B95902590A5B805DDB5E7A5E7F5EF4..5F505F515F61961D4E3C4E634E624EA351854EC54ECF4ECE4ECC518451865722..572351E45205529E529D52FD5300533A5C735346535D538653B7620953CC6C15..53CE57216C3F5E005F0C623762386534653565E04F0E738D4E974EE04F144EF1..4EE74EF74EE64F1D4F024F054F2256D8518B518C519951E55213520B52A60000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1250.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.3578844928761034
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CqHVBUlJvRj7SOVbusZhAMiZyi77q8ujr4z8tjsuVO6ys2K:JMlBVnrAMiwMm8ujr4z8emTys2K
                                                                                                                                                                                                                                                MD5:9568EDE60D3F917F1671F5A625A801C4
                                                                                                                                                                                                                                                SHA1:4F5B3308FE7F6845B46779DECF9B395E47AC7396
                                                                                                                                                                                                                                                SHA-256:E2991A6F7A7A4D8D3C4C97947298FD5BACB3EAA2F898CEE17F5E21A9861B9626
                                                                                                                                                                                                                                                SHA-512:9C32BE3E25FC2211CE91F7B9AE1F9EBA20071272BE2BBBA63A8B6E3CD6543C4C32CD62C4C4D153C94F5BE212E974A61EEFD70DDC005F1688D09D9D56E8E298A8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1250, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0083201E2026202020210088203001602039015A0164017D0179..009020182019201C201D202220132014009821220161203A015B0165017E017A..00A002C702D8014100A4010400A600A700A800A9015E00AB00AC00AD00AE017B..00B000B102DB014200B400B500B600B700B80105015F00BB013D02DD013E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300E40

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1251.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.358948900439905
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CTHVBUlJvRj7SOVbusZhAMiZyi77qpREwKsF/+++SAJlz9aRme3cJI:wMlBVnrAMiwMmpKwKm/EYnsJI
                                                                                                                                                                                                                                                MD5:83DAF47FD1F87B7B1E9E086F14C39E5B
                                                                                                                                                                                                                                                SHA1:77AE330512EBFEF430A02213644BD1CFCE174298
                                                                                                                                                                                                                                                SHA-256:0AA66DFF8A7AE570FEE83A803F8F5391D9F0C9BD6311796592D9B6E8E36BE6FC
                                                                                                                                                                                                                                                SHA-512:D7CE2F44EDFE1DA6D3E07E9A41BB08AD42430BAAFADD09FD217F4B524323A01A1F4913B640C552D38AAEBFF75B0D50ED7A813A2A57C4019311158890C0162DF9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1251, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..04020403201A0453201E20262020202120AC203004092039040A040C040B040F..045220182019201C201D202220132014009821220459203A045A045C045B045F..00A0040E045E040800A4049000A600A7040100A9040400AB00AC00AD00AE0407..00B000B104060456049100B500B600B704512116045400BB0458040504550457..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..043004310432043304340

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1252.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.292994562910468
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:C4HVBUlJvRj7SOVbusZhAMiZyi77qdmV/rcwvGNNlkL+rSMH+tKv:rMlBVnrAMiwMmd2r/okLz0
                                                                                                                                                                                                                                                MD5:E9117326C06FEE02C478027CB625C7D8
                                                                                                                                                                                                                                                SHA1:2ED4092D573289925A5B71625CF43CC82B901DAF
                                                                                                                                                                                                                                                SHA-256:741859CF238C3A63BBB20EC6ED51E46451372BB221CFFF438297D261D0561C2E
                                                                                                                                                                                                                                                SHA-512:D0A39BC41ADC32F2F20B1A0EBAD33BF48DFA6ED5CC1D8F92700CDD431DB6C794C09D9F08BB5709B394ACF54116C3A1E060E2ABCC6B503E1501F8364D3EEBCD52
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1252, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030016020390152008D017D008F..009020182019201C201D20222013201402DC21220161203A0153009D017E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300E40

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1253.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.422723556981327
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CRHVBUlJvRj7SOVbusZhAMiZyi77qduWn4T5K9QQSqiWeIDDdn:CMlBVnrAMiwMmduWnSKyQSqiWeIVn
                                                                                                                                                                                                                                                MD5:441B86A0DE77F25C91DF1CD4685F651D
                                                                                                                                                                                                                                                SHA1:D1E429916BC9423F55EEC8F17941521E9FE9D32B
                                                                                                                                                                                                                                                SHA-256:5B8D47451F847C1BDE12CACA3739CA29860553C0B6399EE990D51B26F9A69722
                                                                                                                                                                                                                                                SHA-512:35DF342DDA4E8790C6D53762465DF8B93B49B7B7E211D7A5753078EF559C9C9383EFF7285A90FF5C0020FBB16AF380EE3C8643F4CEB1E41917E72021079D722F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1253, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202100882030008A2039008C008D008E008F..009020182019201C201D20222013201400982122009A203A009C009D009E009F..00A00385038600A300A400A500A600A700A800A9000000AB00AC00AD00AE2015..00B000B100B200B3038400B500B600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303B40

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1254.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.307590929679485
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CWHVBUlJvRj7SOVbusZhAMiZyi77qdjrcFvGNNlkBSMH+tA/b:lMlBVnrAMiwMmdjriokgzAD
                                                                                                                                                                                                                                                MD5:5FA9162BEC5A4DEA97B5EA2840CFB065
                                                                                                                                                                                                                                                SHA1:F26858E3D2FB928F39CA87CBB8446AF099570CAD
                                                                                                                                                                                                                                                SHA-256:31639CA96A4D3602D59BD012540FE179917E0561CB11A0D0B61F1B950EB76911
                                                                                                                                                                                                                                                SHA-512:3CE7BEABBE1A0CB946149D263D3317A8B791F6D72C49DEC4621E27F50CC359D8FA3EE97C03FF05D44E47DAA59DB87F219386467614B8B3FF8CC21AB3E3BED5E6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1254, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030016020390152008D008E008F..009020182019201C201D20222013201402DC21220161203A0153009D009E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300E40

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1255.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.3385880810272774
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CfHVBUlJvRj7SOVbusZhAMiZyi77qdIn2hEeGlRhv6Mw6Kcv:MMlBVnrAMiwMmdInSEdhvrj7
                                                                                                                                                                                                                                                MD5:6DEA4179969D6C81C66C3B0F91B39769
                                                                                                                                                                                                                                                SHA1:7E2722576BFFABC3258C5EDB2D99FA2468D6A4B0
                                                                                                                                                                                                                                                SHA-256:47576CAE321C80E69C7F35205639680BF28010111E86E228ED191B084FAC6B91
                                                                                                                                                                                                                                                SHA-512:91CC626B6454517F06FB3616E9ED623D1A2A4BFE74AFA9885F00F6AEC835D8825A5587091B9D9AB0E5ABDA291FA3FE7CE87E2618E21EB2974D9118AE27B8A2FF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1255, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030008A2039008C008D008E008F..009020182019201C201D20222013201402DC2122009A203A009C009D009E009F..00A000A100A200A320AA00A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE00BF..05B005B105B205B305B405B505B605B705B805B9000005BB05BC05BD05BE05BF..05C005C105C205C305F005F105F205F305F40000000000000000000000000000..05D005D105D205D305D40

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1256.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.4033510023542655
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:C0HVBUlJvRj7SOVbusZhAMiZyi77q30pPE7Lym4cwGm+AMZjyG/JQIG/Y:XMlBVnrAMiwMm30FQLym4ys6Jg/Y
                                                                                                                                                                                                                                                MD5:D50DFAFEE5C605C5C00A25A9EEE4D4CF
                                                                                                                                                                                                                                                SHA1:7D51BC17931D3D809716C06E7F07C6011286A144
                                                                                                                                                                                                                                                SHA-256:29340EA8E5AD3532BF67FA77CC852F055081B1238925CB109908AA72804CCC04
                                                                                                                                                                                                                                                SHA-512:D0A9B422A1061D6239E442767069B987E33239FCBA9BACE677923888F5F8BD1DCAABC71B83A985A0A86A15DCC44316781665BBFBF24558FCB94FDA6783285BCB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1256, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC067E201A0192201E20262020202102C62030067920390152068606980688..06AF20182019201C201D20222013201406A921220691203A0153200C200D06BA..00A0060C00A200A300A400A500A600A700A800A906BE00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B9061B00BB00BC00BD00BE061F..06C1062106220623062406250626062706280629062A062B062C062D062E062F..063006310632063306340635063600D7063706380639063A0640064106420643..00E0064400E2064506460

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1257.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.344584404753015
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CNHVBUlJvRj7SOVbusZhAMiZyi77q8uWTfNL4wIBUioGndt:uMlBVnrAMiwMm8uWJDNIt
                                                                                                                                                                                                                                                MD5:CC3D24543FDD4644BBBD4AAB30CA71BC
                                                                                                                                                                                                                                                SHA1:8E2658E7F782F005411BCB8423BDFC3C68BDED14
                                                                                                                                                                                                                                                SHA-256:C15AB85438728BF2C60D72B1A66AF80E8B1CE3CF5EB08BA6421FF1B2F73ACDF4
                                                                                                                                                                                                                                                SHA-512:5ECABF820098F7D24AB806ADD9CA3E1087C29914FB2DE6BA3DC656234202DE3FDF80A7E9ED433CCB2149FF07184F74884CEB37A1B689E9E0C1402916F3E13AFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1257, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0083201E20262020202100882030008A2039008C00A802C700B8..009020182019201C201D20222013201400982122009A203A009C00AF02DB009F..00A0000000A200A300A4000000A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B300B400B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F0101010700E40

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp1258.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.2984943182702593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CKlHVBUlJvRj7SOVbusZhAMiZyi77qdIQ2jFvGNNykoxWi3/i:xMlBVnrAMiwMmdIQufkoxn3q
                                                                                                                                                                                                                                                MD5:12BCEAE6B6A5FAE5AE9C42F5998BA485
                                                                                                                                                                                                                                                SHA1:C9620DA0C763D2C3770386E69EE7E421BD1BA965
                                                                                                                                                                                                                                                SHA-256:29D93DEE7C01B2264778BC6B75F6EF76EA6AC53E9F4A334D83707229E7F482D2
                                                                                                                                                                                                                                                SHA-512:714BAF58462FB0E84A32D82C8FC2D63EDF78DF8CCE578391E2521737F94F860B5CCFE41B481E1D09879A6811FCFD8B98A2724DB1D15749BD5293A9B33BCAD071
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp1258, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030008A20390152008D008E008F..009020182019201C201D20222013201402DC2122009A203A0153009D009E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C2010200C400C500C600C700C800C900CA00CB030000CD00CE00CF..011000D1030900D300D401A000D600D700D800D900DA00DB00DC01AF030300DF..00E000E100E2010300E40

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp437.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.515546664597914
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CFyHVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBIqE18wDyV8mK:wyMlBVnrAMiwMm+VhE1LmK
                                                                                                                                                                                                                                                MD5:CE6D8A6542DC12D1783084FA4B2B63EA
                                                                                                                                                                                                                                                SHA1:5039A350C8E3E2C6F353B438B41BD0B6A7AB8069
                                                                                                                                                                                                                                                SHA-256:E5613C04D3D2EE44CCAD85AE53A37C257674491C540836E5D942BBCC4E4A8DB4
                                                                                                                                                                                                                                                SHA-512:E8C5CFB747486BBE0E567B6E87B59D5246D749A80C8F64F6669227C7FD849886F98A1F94451922AC099409AC14890F1A8B1E5F25EA584FDB1522ACE3AD0BE6A6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp437, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00A200A300A520A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp737.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.6177058818384693
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CjHVBUlJvRj7SOVbusZhAMiZyi77qSKOQFhWehDrq18wDyVKockoiH:WMlBVnrAMiwMmSKOQFhWeh3q1odH
                                                                                                                                                                                                                                                MD5:8EF3CBCA101F5777846D12D3C96A0A7D
                                                                                                                                                                                                                                                SHA1:5EC5418B861894E0F18EA15AA4414019815E2EA2
                                                                                                                                                                                                                                                SHA-256:A0415F14F5D72AD24E9C3A5C91517A0E3D22E1ADBC3505C0C6E918B961F7A07D
                                                                                                                                                                                                                                                SHA-512:FB14C88E61E5459B4A8706751D88D0A261AC6B4171F72912D87CE78A2BC97A821CCF5B53676FB229C08F9E557BE624F4DC649B722A906B9B7944ED2D5E7F9065
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp737, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..039103920393039403950396039703980399039A039B039C039D039E039F03A0..03A103A303A403A503A603A703A803A903B103B203B303B403B503B603B703B8..03B903BA03BB03BC03BD03BE03BF03C003C103C303C203C403C503C603C703C8..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03C903AC03AD03AE03CA03

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp775.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.451057608106102
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CsOHVBUlJvRj7SOVbusZhAMiZyi77qoo9ecL067J4ZNUPVw3PfA:AMlBVnrAMiwMm59T067KDLPo
                                                                                                                                                                                                                                                MD5:9656761FA02EA24773EAD3E5C4BDB975
                                                                                                                                                                                                                                                SHA1:366228F25392708FA799E9CC0830CE9917EF6CA7
                                                                                                                                                                                                                                                SHA-256:C3C6542E902DEC2C44DDCFD8B5CB7ABF309B0413A7CED1614DC0B20CF7C5E35F
                                                                                                                                                                                                                                                SHA-512:A6A44B9A2193D75764DC284BE53264E57BFEB2A221FD54B4577DD90752F69A45E6B9D293108A7AB895F347A24FD10AAE84954A043AB1F466F485D707D7412380
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp775, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..010600FC00E9010100E4012300E501070142011301560157012B017900C400C5..00C900E600C6014D00F6012200A2015A015B00D600DC00F800A300D800D700A4..0100012A00F3017B017C017A201D00A600A900AE00AC00BD00BC014100AB00BB..259125922593250225240104010C01180116256325512557255D012E01602510..25142534252C251C2500253C0172016A255A25542569256625602550256C017D..0105010D01190117012F01610173016B017E2518250C25882584258C25902580..00D300DF014C014300F500

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp850.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.3718781469586827
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:C9HVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBc+myS5LeQDTVwA:EMlBVnrAMiwMm+VeyS5SQn/
                                                                                                                                                                                                                                                MD5:2169EE726DCC011E6C3505D586C88FC3
                                                                                                                                                                                                                                                SHA1:094252AD0634787E2D7F0D28A448437054D359C7
                                                                                                                                                                                                                                                SHA-256:13DF611F429A9B331DA1B34F3C718CCCAF0BD4AB44F71A9C632197987B4D643B
                                                                                                                                                                                                                                                SHA-512:BC5831EF1C131095A22C76FFCB5C4217081AF796B60455BE2DE2E2689CFE1033F07E8B45449F77E7804A7D52CBCFB916B0B4639828E65B14475BB3367F47C8EE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp850, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D800D70192..00E100ED00F300FA00F100D100AA00BA00BF00AE00AC00BD00BC00A100AB00BB..2591259225932502252400C100C200C000A9256325512557255D00A200A52510..25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4..00F000D000CA00CB00C8013100CD00CE00CF2518250C2588258400A600CC2580..00D300DF00D400D200F500

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp852.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.4509005787389877
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CPHVBUlJvRj7SOVbusZhAMiZyi77q7EUsOtycwQIc+922V:mMlBVnrAMiwMmwvOtycwQIc+9R
                                                                                                                                                                                                                                                MD5:48402B424B5101BDEEB0192BBA96DB7D
                                                                                                                                                                                                                                                SHA1:C9EB93A37AF70F4134AA9CF05D914A30FB3201DD
                                                                                                                                                                                                                                                SHA-256:F3A18A8C7934F6586F023477E08D3F9D5EAD9A45E9E58A3F8D018AF9BB13F868
                                                                                                                                                                                                                                                SHA-512:4EE615605BFF3D94A7FC4FE23D8288F0F20F6792C8C69ECACABAE82F1A334D8417C5DFFC0DA3702E2DB09B7BE1E5FF19C6A0F460C9A5EC84D1856BB9C8061CA5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp852, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106..00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D..00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB..2591259225932502252400C100C2011A015E256325512557255D017B017C2510..25142534252C251C2500253C01020103255A25542569256625602550256C00A4..01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580..00D300DF00D40143014401

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp855.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.4277025591531864
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CoHVBUlJvRj7SOVbusZhAMiZyi77qLHVWjwk/rMZC032SLnD2JbD:hMlBVnrAMiwMmx8whM03VLDy
                                                                                                                                                                                                                                                MD5:8B8AA56F83BA750EB73FAE542E76FF1A
                                                                                                                                                                                                                                                SHA1:2F3C3BA4B854A7D6B0A3D27BC519EE66A042E05A
                                                                                                                                                                                                                                                SHA-256:E64FD2E639DA6F654D9BFBB2266F9432259A6A55941622F5CDDC3797E382EB0A
                                                                                                                                                                                                                                                SHA-512:8B4061176663F7AC01B3969D25F680B5870A8EAD864CFAD897F18E75409CE721E6CC367A88EBABAF72E77D4542EE1894F2A6EE47A43FB3D4C650CFA18DFD3D71
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp855, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0452040204530403045104010454040404550405045604060457040704580408..04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A..0430041004310411044604260434041404350415044404240433041300AB00BB..259125922593250225240445042504380418256325512557255D043904192510..25142534252C251C2500253C043A041A255A25542569256625602550256C00A4..043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580..042F044004200441042104

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp857.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.364496856690505
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CaHVBUlJvRj7SOVbusZhAMiZyi77qZpu6uUV5Dw5LeBCVHjzA:jMlBVnrAMiwMmyUVFw5SYdI
                                                                                                                                                                                                                                                MD5:BA52A031DE1B1A6ED1C41BED8946750C
                                                                                                                                                                                                                                                SHA1:BD54C0E2F62FD36675892A61FD8B340A56845D20
                                                                                                                                                                                                                                                SHA-256:B6CD5C6F2B54D89142679D599ED0A5DEE6955A3B3F6B6673E46AFE7A5A303CDC
                                                                                                                                                                                                                                                SHA-512:5F915AABE39F31CE9337B4B9B0239DF8ADA898D2D9F111DD09D97689DB89CF45B093AC187FC28484CFB213D14B0D8F58C5668D0A59726282D6F52D5D24697816
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp857, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5..00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F..00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB..2591259225932502252400C100C200C000A9256325512557255D00A200A52510..25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4..00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580..00D300DF00D400D200F500

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp860.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.506813480871637
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CMHVBUlJvRj7SOVbusZhAMiZyi77qij4Axlt49Y18wDyV8mK:VMlBVnrAMiwMm/g+9Y1LmK
                                                                                                                                                                                                                                                MD5:C416471B57FB894DC45D30C31B4BD2E2
                                                                                                                                                                                                                                                SHA1:BA378F8122280992AE51245A06814D8155564220
                                                                                                                                                                                                                                                SHA-256:804EFA345C5BBBAD2449C318A7A3F5B31F4234712AAD23DC49B3FB5AA33B7A57
                                                                                                                                                                                                                                                SHA-512:E7CDE706CFE573525C2DE319AD5783AE9D97C4F6D28B14A77A729F281540B0DAFAD4C14879EF76473BFDEBC38499C65CA228470983F2D1BC31938A91A2486522
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp860, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2..00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3..00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp861.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.5174672833207183
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:ClHVBUlJvRj7SOVbusZhAMiZyi77qZpORVPnA2Gm18wDyV8mK:8MlBVnrAMiwMmiVPAA1LmK
                                                                                                                                                                                                                                                MD5:4997979FD1692063E2B9AA9870E0BE4C
                                                                                                                                                                                                                                                SHA1:919012354B99BBEF4C85517E89A2C9CD340FCE49
                                                                                                                                                                                                                                                SHA-256:4B7E76AEB75289FACA76434EA6E9874E9504AD2BC3D8D47550EADBCC8294857E
                                                                                                                                                                                                                                                SHA-512:C122A1AE2DE79CB97E5989535B7478A76D905CDE60B01F80F5B84EDB9DF08BE6829E1811AF19608971DA048B8DA24F40DE0217A8054AC612EC2D8B3560500FBE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp861, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5..00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192..00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp862.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.5573268031592717
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CdMHVBUlJvRj7SOVbusZhAMiZyi77q36AqE18wDyV8mK:iMMlBVnrAMiwMmq3E1LmK
                                                                                                                                                                                                                                                MD5:9B4D1B95B20BD67555517DCC3007B22A
                                                                                                                                                                                                                                                SHA1:2C0D6121DB49CDAB6FBAA81398BE2E44BE4E1110
                                                                                                                                                                                                                                                SHA-256:6C15CB256B1C22170292589C6F589E64E164EB36EC7E84F0BD48149BABB7C5FC
                                                                                                                                                                                                                                                SHA-512:34C3E401364D579E8AC7A4E1F1F7A29A84C62E1D5146D7664832639EA3997227DC4BAF1B64DC605E6574D680E61B55D0C69C329E35B1BEC41501FC68C5B634B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp862, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF..05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp863.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.518080906819747
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CXHVBUlJvRj7SOVbusZhAMiZyi77qwGuXVFq5EC18wDyV8mK:eMlBVnrAMiwMmw3VFu1LmK
                                                                                                                                                                                                                                                MD5:C93CCDF65F7F349F22855745660F02AE
                                                                                                                                                                                                                                                SHA1:604888B1FB3C57DF47277CDD1153597BA89E8C36
                                                                                                                                                                                                                                                SHA-256:232D6FE34D7151920232EAAE9C515F36400AB64136DCC5B802D6245AC6F5D56B
                                                                                                                                                                                                                                                SHA-512:D5B65AE7353F694A37AF29177BF1A95477918FC5A002C2FE199624BD5B391698807BAECF54225BC40F62B3CA7912C7066A4AAF01B9E3E399133831CAA342BF4F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp863, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7..00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192..00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp864.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.72017408907567
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CwHVBUlJvRj7YOVbusZhAMiZyi77qcHj92OibcDQAyUjSG:5MlrVnrAMiwMmSsNcDQvcSG
                                                                                                                                                                                                                                                MD5:146E0D1779D50E070E0EF875E8374DF8
                                                                                                                                                                                                                                                SHA1:B51E5598712598BC387DD79AE80BD879F139140D
                                                                                                                                                                                                                                                SHA-256:81BEBFD9A61E9F17495763B68D57742FAB2A1A43871015699A2C8E5FDED4EC19
                                                                                                                                                                                                                                                SHA-512:1F0DAD8E77712C5A018894332BE72FF5C546C92F481421CCB8553AD6F1E9A18617765C8CEE4187265CCCB1AB073E221289D34C9AB1F0501231D52C81FC1C932B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp864, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00200021002200230024066A0026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00B000B72219221A259225002502253C2524252C251C25342510250C25142518..03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F..00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5..0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F..00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9..FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9..0640FED3FED7FEDBFEDFFE

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp865.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.5193842128126676
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CsKHVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBnAFj18wDyV8mK:gMlBVnrAMiwMm+VRAFj1LmK
                                                                                                                                                                                                                                                MD5:150B2E00B3F84F8075F3653ED7A4C8E0
                                                                                                                                                                                                                                                SHA1:7131DC656EFE1F2277B19DA72F0EEB46B4EC54A0
                                                                                                                                                                                                                                                SHA-256:ADA1A52064EE93EBE6F8A5D101D01F8776038E12F21A5CA1C006EE833577C705
                                                                                                                                                                                                                                                SHA-512:AC56EEB0220826BF8FF6CA52768DB63961AAC46095A2F3EEBA11B5973CC92AF52DFBBE9E85A0DD04CAB8998212FA2599EDD83BAAA7FB2D394E330FF2F7C015DB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp865, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp866.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.5038992968715266
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CCHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9aRme3cB18wDyVNZkR:bMlBVnrAMiwMm8YnsB1wZy
                                                                                                                                                                                                                                                MD5:FC33B5F773E87696A69E8798446E9772
                                                                                                                                                                                                                                                SHA1:4FC5589C1DD88BB8171758BC173A63B3A5687AE5
                                                                                                                                                                                                                                                SHA-256:32A45DEBA933C7ED99141535087A4C99BA79802175E3F762ACA6EB941157F85A
                                                                                                                                                                                                                                                SHA-512:332D2FEC532192F58F792441E61D675A8692C36BECF768D07F64B8C31561CC1A2DF402625A4719E758A9B59DE4228FFE9F94F067E7DC0D82F9DA2D6500E50304
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp866, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..0440044104420443044404

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp869.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.5261138894265507
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CtHVBUlJvRj7SOVbusZhAMiZyi77qii+lh2o5+hdVMQFhWgCDrKE:EMlBVnrAMiwMmXY2o5+hdVMQFhWf3f
                                                                                                                                                                                                                                                MD5:4A2C66AA630D4AE2BF1E7546DCE2DAE5
                                                                                                                                                                                                                                                SHA1:FABB672957D21CA2B4E0EACA5FCE6093BAACF77A
                                                                                                                                                                                                                                                SHA-256:AFE6ED6EB5D07C45B6B928A48BC5EF57EFCF61602D36FF9FBDE4A8EA3FA6DF75
                                                                                                                                                                                                                                                SHA-512:A548002EB7AF8735DBBBCC9883B44B326F261C02A3C7CE65C373755DD92212A66740112EAE0FC556CAD5B86911709C6DF12167DC5B6AD1E01C6F1EB5AB16DB37
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp869, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850386008700B700AC00A620182019038820150389..038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF..03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB..25912592259325022524039A039B039C039D256325512557255D039E039F2510..25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3..03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580..03B603B703B803B903BA03

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp874.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1110
                                                                                                                                                                                                                                                Entropy (8bit):3.33737382140564
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CSyHVBUlJvRj7SOVbusZhAMiZyi77qVQEHmEU4AyqU+TWwdd:CMlBVnrAMiwMmWr4AyqUSd
                                                                                                                                                                                                                                                MD5:FC8C876B4738236FC71A1AF96E4566D0
                                                                                                                                                                                                                                                SHA1:DDFDC3F62D99A6BD705CF0719B50F66449C8808A
                                                                                                                                                                                                                                                SHA-256:4F05F31CA026BBFEEEE49ED86504CB060784137A9CFAE0E5954D276E837AB5DE
                                                                                                                                                                                                                                                SHA-512:5BF58A810E029840825FFF3318E90415E6F2B7E46032FD428B4971923D41A64C127A6F438E4894E80EC9604CD34F1D47B4F9A02ABAB3E7D6351611811DC1F2B9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp874, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC008100820083008420260086008700880089008A008B008C008D008E008F..009020182019201C201D20222013201400980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E440E

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp932.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):49008
                                                                                                                                                                                                                                                Entropy (8bit):3.5144574650895364
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:R/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSY83+JRS:RVUidzJCurDGSYvW
                                                                                                                                                                                                                                                MD5:EF4508C84A025095B183E6BAD67B1ECD
                                                                                                                                                                                                                                                SHA1:D12D5381D50D578AA8687671DC542C462A7F490D
                                                                                                                                                                                                                                                SHA-256:6D1B512110BEAF2CD1296AC878F51D567848AB4A1CED4F18C72806BB136B3D23
                                                                                                                                                                                                                                                SHA-512:E695E7E6F4A11D5E8D62982E26B69B87DB2F1F3D6B6DCCD5F1DF51879F5C4533265CBD7B785E1F2652D8CA3FC913D4F862E7575F67C636314A6E6956FD96E023
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp932, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp936.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):134671
                                                                                                                                                                                                                                                Entropy (8bit):3.5217328918779645
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:+CwDua7D90Jz1aDJmnMfEGniOQdH6prJs3inqlW6/t9Qwf+zCt5:j1WVRpe3rpt9hf+Gt5
                                                                                                                                                                                                                                                MD5:CF9CFD6329A4FB6C402052B9417DAC3A
                                                                                                                                                                                                                                                SHA1:75CE13FE1E5898D47B67F951C0C228851F1CC04D
                                                                                                                                                                                                                                                SHA-256:B6EC2BE0504CA62B9D1B6857F6BAA13FFAC5A567D4432F4EAB98ADC830F5D9C3
                                                                                                                                                                                                                                                SHA-512:7E19607EEA5342ECFE92D56DAAE82827DE147AE5AFDA8E9D67FD0970F528902CDE20A8A07CF2F341B926E59BB4FF792872976F1C7C5CD351959A71A8B6A1924A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp936, multi-byte..M..003F 0 127..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp949.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):132551
                                                                                                                                                                                                                                                Entropy (8bit):3.100976362851161
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:2UO8ecy5KnSMsDlOmNpkQ4oQHnTApv+ngLbiyEY:2U/etc/sBRZp//r
                                                                                                                                                                                                                                                MD5:03E19A4DE3490A7DC50D04EC1F558835
                                                                                                                                                                                                                                                SHA1:9DFECAE08C98109EAA358F5920AED647888F722B
                                                                                                                                                                                                                                                SHA-256:477F8B79B67F4A22C963EE65B9B387DBD8E4B8F62D800B0A51D2276580C6ADBB
                                                                                                                                                                                                                                                SHA-512:7D6AD30AF75A3AA6332A860C6ABF87BF725EB6B4AF3B37699043A10EF3235471C63D0ECB4D437D5AD9438DF5DA646EB55117A9BB8B55EF6868F71E49035C18B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp949, multi-byte..M..003F 0 125..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\cp950.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):93330
                                                                                                                                                                                                                                                Entropy (8bit):3.319807723045599
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:aAHU3LIkZlmXrd/uQ0ao98ggKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fW:aVduBGf9PgFMT6q95GDRBfW
                                                                                                                                                                                                                                                MD5:1D84B025DAB127F2073947D764D307B6
                                                                                                                                                                                                                                                SHA1:4E3D3CBD96D084836F1FE6F2AA497E3FAA463B9B
                                                                                                                                                                                                                                                SHA-256:F80E05533D1A1494C32F9412E9AD2D9C11FAF9AE0668A6F9D1FA5CEEDC6870E2
                                                                                                                                                                                                                                                SHA-512:188D649F9717F20524AFF47F85C3B23AEC3E7825BF54975285D06C17587D581DC24A3F6A7CAB1703DE7AD5521FE2FE2572DE627A81E6A48049A47BB219ED4AF8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: cp950, multi-byte..M..003F 0 88..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\dingbats.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1113
                                                                                                                                                                                                                                                Entropy (8bit):3.7780987266961663
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:vJMHkUlJvRjmf9RCsUBOdXsCbbNviANpk3m1XFAoE4xSF5HrBPkdn:vKvlA9RCs6CXrViAN51XFA9eSvdPKn
                                                                                                                                                                                                                                                MD5:90FE0C57BBC6C2D8A3324DEB7FD45F3D
                                                                                                                                                                                                                                                SHA1:06B95BE43E4C859A0F1B01384EDD26500C6C1F9E
                                                                                                                                                                                                                                                SHA-256:EB9B262E4D179268E6F017C0D4EF0E7034E31A5B4893595D150640CA1F6A1C45
                                                                                                                                                                                                                                                SHA-512:6A5E67D9F3EC6046C42793E1437B8A6E50EBD72D8EC67FEFEB6DAD6FAB6A5B5C74F939363587D5A6529E217AF54FB8A9CF0F768E114DD931C57887451CACE56E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: dingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A327A

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\ebcdic.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1073
                                                                                                                                                                                                                                                Entropy (8bit):3.0039861897954805
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:XXBcIhJZDgEoQkNCGz0Jyh9lZk3Vmd2QhZLXPiALV3d:dTcNCJEhfZk3Vzox/iqVN
                                                                                                                                                                                                                                                MD5:F7B3771D43BDE6AFF897683BED2FE6AD
                                                                                                                                                                                                                                                SHA1:E70C2C0902413536CB6163752D70F3AE4AF6A967
                                                                                                                                                                                                                                                SHA-256:165BE658AB7D61FFC3DF1E2F1438C2F9FCEE6808A756316302157F44E6D3ACD7
                                                                                                                                                                                                                                                SHA-512:F87DC718EB2DD95237B144FDA090BB636121B9479E492AC94E4F7EBDD88171F070B9E9F6165BDA7B7E2BA2A3E6188B1108D8F91AA5F142CCCFDAD317628DD941
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:S..006F 0 1..00..0000000100020003008500090086007F0087008D008E000B000C000D000E000F..0010001100120013008F000A0008009700180019009C009D001C001D001E001F..0080008100820083008400920017001B00880089008A008B008C000500060007..0090009100160093009400950096000400980099009A009B00140015009E001A..002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C..002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F..002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F..00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022..00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1..00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4..00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE..00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7..00F900410042004300440045004600470048004900AD00F400F600F200F300F5..00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF..00D900F70053005400550056005700580059005A00B200D400D600D200D

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\euc-cn.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):86971
                                                                                                                                                                                                                                                Entropy (8bit):2.3925661740847697
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
                                                                                                                                                                                                                                                MD5:C5AA0D11439E0F7682DAE39445F5DAB4
                                                                                                                                                                                                                                                SHA1:73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
                                                                                                                                                                                                                                                SHA-256:1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
                                                                                                                                                                                                                                                SHA-512:EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\euc-jp.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):83890
                                                                                                                                                                                                                                                Entropy (8bit):2.350315390677456
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:2GhX8nuQ635vlHptHzh0abNQPQA0OMS2HhFV3:2GikvRpMuNQ4P73
                                                                                                                                                                                                                                                MD5:F2DE0AE66A4E5DD51CC64B08D3709AAB
                                                                                                                                                                                                                                                SHA1:97558A51A6DD6C56FC7A42A4204141A5639021FD
                                                                                                                                                                                                                                                SHA-256:A3C916BA16BCAC9FAA5A1CCC62ACA61452D581CD8BA3EE07EC39122C697274C9
                                                                                                                                                                                                                                                SHA-512:0EAA90100527FF150D2653D7BB57647D69E592BE53B714DDD867114CFCC71E3A76882772F4FAECE040DF09FA8971D1C22DECC497E589B4CA827A6890497A48D9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: euc-jp, multi-byte..M..003F 0 79..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D0000008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\euc-kr.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):95451
                                                                                                                                                                                                                                                Entropy (8bit):2.4080588863614136
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:4/vO7UlClqAd8XfpUqv+mCoKRuLbtMjnIxz0DY:4nO4N9fpv+ngLbiyEY
                                                                                                                                                                                                                                                MD5:103843B3A57168BD574F6CACC550D439
                                                                                                                                                                                                                                                SHA1:982652EA2B0DCFBB55970E019A4EDFBFCFAF9C24
                                                                                                                                                                                                                                                SHA-256:5448643398685456A11CBB93AF2321F70B8659E2FFF3CCC534B4D53BD2F38C89
                                                                                                                                                                                                                                                SHA-512:27A8DE6F97DB4A96E5D0132692A32A99DAB8A6C98973A0C4E50A219F2D2F364E63D657E5E8478B2706CA33C45C376F55B5BFCC9459E06AEA88BFCD4F0E32525C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: euc-kr, multi-byte..M..003F 0 90..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\gb12345.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):88033
                                                                                                                                                                                                                                                Entropy (8bit):2.3790651802316996
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:o4Is/C+0IwpRK1CkinIKUyNiNBzxOC4T/:LIsR0/RKckiIgNiDtOxT
                                                                                                                                                                                                                                                MD5:1A8E55DEA98B6D5EAC731ED233D3AD7C
                                                                                                                                                                                                                                                SHA1:1335FC0FC2AAE7E7F5EC42AC17A4168368B4A64D
                                                                                                                                                                                                                                                SHA-256:B4894AEDD2D5B5AE54B6D2840F7C89A88E9308EFD288F179E65936E172EF4B0D
                                                                                                                                                                                                                                                SHA-512:9DDCE366BA1196EB9FB913ACFDE8516BC9BB8D51894866D2E7E8CB313DC4D6C6D33C5A9E78142E83594DC423D10DA6F8DE211E69844B939198BC7DB9AED808F0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: gb12345, double-byte..D..233F 0 83..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\gb1988.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.270324851474969
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:qrmHVBUlJvRj76OVbusZhAMiZyi77qN8VmKfkiJt0RMFS:qSMlZVnrAMiwMmNPYPFS
                                                                                                                                                                                                                                                MD5:D06664ACAA478BDEB42B63941109A4E3
                                                                                                                                                                                                                                                SHA1:4A6196FCC1BDE988C1A23EAA69745A9979F1AEFF
                                                                                                                                                                                                                                                SHA-256:ACD50951F81566C8D823670F9957B2479102EB5AE4CF558453E1D8436A9E31FF
                                                                                                                                                                                                                                                SHA-512:CB51A36B851FFDB5C6F9B9D0333EEA6A14CEF3796E0A60530198C16999D64E638047E873333630360299C9126F79CEDDA2D9F169028CED1FC04B1D3C55FFFC5B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: gb1988, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..002000210022002300A500250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\gb2312-raw.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):85912
                                                                                                                                                                                                                                                Entropy (8bit):2.3945751552930936
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:D47/S+i8vdx3Tz+hpHcBrQqKtrebjMIGCx8jE:0c873T6DHcBrbKtrVlE
                                                                                                                                                                                                                                                MD5:9357E05C74D6A124825F46A42B280C14
                                                                                                                                                                                                                                                SHA1:E5106ABE12D991AFE514F41E3B9E239202A4ADFE
                                                                                                                                                                                                                                                SHA-256:C445E4C9F676AE997D2DDA2BBC107B746F3547D85F39479951C56F46275EE355
                                                                                                                                                                                                                                                SHA-512:B2187D70A92FB38572BA46F3C3443233BEED1A4ABBFBA1B860F4BBAE6B3D8C16B8C9F52A20DAA12B2B8B40972E52F816860427B743530177E4CF0D8BA34EF381
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: gb2312, double-byte..D..233F 0 81..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\gb2312.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):86971
                                                                                                                                                                                                                                                Entropy (8bit):2.3925661740847697
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
                                                                                                                                                                                                                                                MD5:C5AA0D11439E0F7682DAE39445F5DAB4
                                                                                                                                                                                                                                                SHA1:73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
                                                                                                                                                                                                                                                SHA-256:1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
                                                                                                                                                                                                                                                SHA-512:EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso2022-jp.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.949409835601965
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SOd5MNXVSVLqRIBXS4ovLE9sDXMVyXK9ow1Deq9Ts5dRPMSXcRA0kcR4X9cL+TXI:SVNFS0oyisLMsXK9okTw/BDSVKNw
                                                                                                                                                                                                                                                MD5:D3AC33390D31705FA4486D0B455247DF
                                                                                                                                                                                                                                                SHA1:2EE8613DC04A6FA84AB38FD5F3A2AA3FE330625B
                                                                                                                                                                                                                                                SHA-256:98074C85650A420A095ADA9138DA3A8A0AA4027BE47EA1E97A596F319EB084E9
                                                                                                                                                                                                                                                SHA-512:CB265B753C84968E2D1D6E706906DA9A7BB796D08F626290BCCA8F089771AFD176A9DC912773E8BA390D2AEC08592AD535C7D254E1DF92CF04848601481D4EFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso2022-jp, escape-driven..E..name..iso2022-jp..init..{}..final..{}..ascii..\x1b(B..jis0201..\x1b(J..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso2022-kr.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):122
                                                                                                                                                                                                                                                Entropy (8bit):4.978693690727393
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SOd5MNXVTEXIBXS4ovLE9sDXNvdwUHEQwqc6XWxVUNOov:SVNFSoyisL/Zzc6mYNHv
                                                                                                                                                                                                                                                MD5:057CB0AA9872AC3910184F67AC6621BC
                                                                                                                                                                                                                                                SHA1:BBA47F9D76B6690C282724C3423BD94E2C320A04
                                                                                                                                                                                                                                                SHA-256:234811FC8B0F8FF2B847D9CC3982F1699DF1D21A43C74DCE45BA855D22520007
                                                                                                                                                                                                                                                SHA-512:019F187D2D16FB51BF627ACB7E67778857E56D4C160E0E5ACA6ABC05EC5FDB624CE2715CB9E0DAD73BFF9D697982BE0D539BC55BCCD368FC7C8EE0FFC04E9F61
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso2022-kr, escape-driven..E..name..iso2022-kr..init..\x1b$)C..final..{}..iso8859-1.\x0f..ksc5601..\x0e..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso2022.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):240
                                                                                                                                                                                                                                                Entropy (8bit):4.95909788984399
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SVNFUXoyisLNcs9ozc6W4Twk0sRBDSVKN6tWIHRy:oUYcLNcTzczbwRYRy
                                                                                                                                                                                                                                                MD5:BB186D4BE3FA67DD3E2DEE82DD8BD628
                                                                                                                                                                                                                                                SHA1:93CE8627038780CFFF8C06E746DD5FB2B041115C
                                                                                                                                                                                                                                                SHA-256:741B4C842557EED2952936204D0AE9C35FA3A0F02F826D94C50C46976291797C
                                                                                                                                                                                                                                                SHA-512:4921E7AA3DB8E33609603FE129B97275DFF80CFB06648D2068FA7950246C67B9B530B74827638F69F4DFB8F55CDD4AA952EA72EAEB6ABB527D52F20C6B46FB51
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso2022, escape-driven..E..name..iso2022..init..{}..final..{}..iso8859-1.\x1b(B..jis0201..\x1b(J..gb1988..\x1b(T..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..jis0208..\x1b&@\x1b$B..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-1.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.236046263464657
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:iyHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkL+rSMH+tKv:iyMlBVnrAMiwMmTmokLz0
                                                                                                                                                                                                                                                MD5:3538A970CD098BF5CE59005FE87B6626
                                                                                                                                                                                                                                                SHA1:285A96CC40D7CCE104FB4B407C7F0C400AA8F9CB
                                                                                                                                                                                                                                                SHA-256:A9CB4F4CA111608F882729BC5EB1C2F15530C515EF02DD2CA62F2D8DC5A210CF
                                                                                                                                                                                                                                                SHA-512:A6A6F2D8B5C22E240D195D168A604887062508FF3340D24E13BFCBD6C2E687347F2CFE724FA2ED12F36915B55EE2CFD901EC3F08E2B0A2FFD3BC2A98BBD12A50
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-1, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-10.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.319750415373386
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:jHVBUlJvRj7SOVbusZhAMiZyi77qimXG2yM6q7KytC:jMlBVnrAMiwMmTXG2gytC
                                                                                                                                                                                                                                                MD5:CBDE40170FECD2496A9DA3CF770FAB7B
                                                                                                                                                                                                                                                SHA1:3E1D74DF6AFEB6CDE8ECBDAC8F81F2F9C64150DE
                                                                                                                                                                                                                                                SHA-256:48F4A239C25354F0E9F83A39F15D4632BB18A9C33E60C671C67307159917ECED
                                                                                                                                                                                                                                                SHA-512:A26B56A4CFE29E5A0A0B3A55283A7767397693388E2DEEC342C69B6F718FAE2407EB8D5ADE538FAE6947CBB8B052943C3A52F2D046ABAC7A3DAA86D730DC293F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-10, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A..00B0010501130123012B0129013700B7013C011101610167017E2015016B014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF..00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF..010100E100E200E30

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-11.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.3206399689840476
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:6HVBUlJvRj7SOVbusZhAMiZyi77qimwHmEU4AyqU+TWwdd:6MlBVnrAMiwMmTf4AyqUSd
                                                                                                                                                                                                                                                MD5:E2A0BCB83BFC3F435CDCFC20D5CF2E0C
                                                                                                                                                                                                                                                SHA1:CFD18B5B5DB4EE46E63D912B8FD66D513C4C8D39
                                                                                                                                                                                                                                                SHA-256:21E769C5A66E4D12D6E7DB24022E92AF1EC0D0331FE3C8C605654F239C0F3640
                                                                                                                                                                                                                                                SHA-512:C86F9180F2F4A177F1EA10E26B0903ABEAFDDE0317C332A48F8D1BB586DAC91C68800E2E4FA2CD739C435419B106CBA4BEFC049F2BCD720E9FC2C0AE8436CFAC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-11, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-13.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.338879965076632
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:olHVBUlJvRj7SOVbusZhAMiZyi77qim2w4kBUioGnd2:olMlBVnrAMiwMmT/WNI2
                                                                                                                                                                                                                                                MD5:21CEBB723D47B1450A7FB21A82470B97
                                                                                                                                                                                                                                                SHA1:A40FD3AFE1ECE89E3F682D527D281BC563DB3892
                                                                                                                                                                                                                                                SHA-256:3271D39D7B4DCD841E8E5D5153D1B8837718B88FEFEC73DC37D314816EEFE5E5
                                                                                                                                                                                                                                                SHA-512:3A0E033A4D93C679215F672C6C4FE425D63E1DE157AA671E7400639165EC3EB498E4EEB030D6FB8FF8BE2FD8C986D341036A8CED9FA094D092CF2822D5DC065B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-13, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F010101070

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-14.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.3670559016263915
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:vHVBUlJvRj7SOVbusZhAMiZyi77qimhw6COlk1fKMH+tiH:vMlBVnrAMiwMmT/tlkQz0
                                                                                                                                                                                                                                                MD5:FDAA88946DE4EB4E6D37F2B6AFCF6CAF
                                                                                                                                                                                                                                                SHA1:56FC4773941E7457EA04EDA92C883642DE45D100
                                                                                                                                                                                                                                                SHA-256:F0A5675027FB1CA34B4E4128D24C2968CD275890569A32A86AFA4994CE4983E0
                                                                                                                                                                                                                                                SHA-512:92658A6FEB42A41B3CFFC377C4A9A3F6780A79FC596D3FEDBA6D3B3D75A9F40E859A2CE8DC579A278BAEEDEEFA2408E2B7853D99D5C2D14AACF63C521FE2BB86
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-14, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178..1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF..00E000E100E200E30

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-15.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.260398494526282
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:mHVBUlJvRj7SOVbusZhAMiZyi77qimmRf4kL+rSMH+tKv:mMlBVnrAMiwMmTmCkLz0
                                                                                                                                                                                                                                                MD5:D779D5E2A0083C616A226B2D82ABF0EB
                                                                                                                                                                                                                                                SHA1:D1657DB5E2989EBA80BAB98A1E1217CFFFBB19DB
                                                                                                                                                                                                                                                SHA-256:C74E8E23A0FF0D5DEA7C318CA20DC817DA4E57B0DD61B3361FC0D5098A9316FE
                                                                                                                                                                                                                                                SHA-512:26E62BE8AE793ED3B725BF0D1BABF4D6ED63A6F3772ABD48955FC4394BDE5A47614D1FF89A21A828676BF1302F3C9361B557B0FBF0DF8561FB7E66542FE94CDC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-15, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF..00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E30

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-16.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.3065938185320918
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:dHVBUlJvRj7SOVbusZhAMiZyi77qim0SmmPkYTtyL:dMlBVnrAMiwMmTttPkYpyL
                                                                                                                                                                                                                                                MD5:74FDEDDAF670023DA7751FB321E345A0
                                                                                                                                                                                                                                                SHA1:0677FED67C1333A9A74D50642E5214701A57E2AF
                                                                                                                                                                                                                                                SHA-256:640D977EC1D22B555C5075798DA009E3523E8F55F29BE22A3050CD1B4EF7B80E
                                                                                                                                                                                                                                                SHA-512:AC02FD95159A856A9DDEF4E6A8216B958DC07311B553FF39403DC5B77E1AFF2A2C4C03F5F26A2BB7AD5DB6800BEE03E895554556DBBFBE89426286796ADE55AC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-16, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B..00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C..00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF..0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF..00E000E100E201030

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-2.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.340505173539446
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:UHVBUlJvRj7SOVbusZhAMiZyi77qim/ssm5VO6ys2K:UMlBVnrAMiwMmT/ssYTys2K
                                                                                                                                                                                                                                                MD5:9B87850646FFE79F3C8001CBCB5BB3A1
                                                                                                                                                                                                                                                SHA1:8F97576F3FB3B5DBEF71DC2C9314AB5E530974D6
                                                                                                                                                                                                                                                SHA-256:76949B03F57041B07F41902BD7505AB3594D79AA8F7BDEED5F0481004B10CBC3
                                                                                                                                                                                                                                                SHA-512:101A28AF0799E7E0A5723E5DD76D5EF0FEEF584AC479A88F499CB3B7D2AA93767D72F8E51C76F7547F08FF8DD3CBBA7FF444BD07F99A92755526E75C596109EF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-2, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B..00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-3.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.2507537230559977
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:tHVBUlJvRj7SOVbusZhAMiZyi77qimw2g0kgTJMkFtoD:tMlBVnrAMiwMmTo0kgTJDoD
                                                                                                                                                                                                                                                MD5:CBD0B9CDCD9BC3D5F2429A760CF98D2F
                                                                                                                                                                                                                                                SHA1:6DEF0343E0357E0671002A5D2F0BFC2E00C8BCF9
                                                                                                                                                                                                                                                SHA-256:1F51E7BDA64D466C16FEE9A120BBE3353A10CEB9DAB119FFA326779BA78D8C5D
                                                                                                                                                                                                                                                SHA-512:88DB6D23B53F4A78133C794ED42FA3F29A4ABAD35DE4B022040FA187AA59B00664CC13F47AFF4507D72F4CB2166F026144213EE760AB0FD67CDD2FA5906F434A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-3, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B..00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C..00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF..000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF..00E000E100E2000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-4.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.3413832766873073
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:KHVBUlJvRj7SOVbusZhAMiZyi77qimX4AsD/njR7Ky8hA:KMlBVnrAMiwMmTXBs3EyuA
                                                                                                                                                                                                                                                MD5:8B620EDECAC2DF15A024C2CE15FB64A5
                                                                                                                                                                                                                                                SHA1:65C5EE5D08964E37393E6A78ABA0DB16D51240E2
                                                                                                                                                                                                                                                SHA-256:66B3CF994F0B5E0103D13E812958320AFB555C91E3F81B579D4CBF231E6A0805
                                                                                                                                                                                                                                                SHA-512:93391325405D3AEA0A913F5EA8EA0391920D10F234C26AB1DA70992702889A3AF7B85E11A1FCA554690942B238CE313DD460798E59C5B1F4069036E7B0F24F44
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-4, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF..00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A..01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF..010100E100E200E300

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-5.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.342721205983665
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:zHVBUlJvRj7SOVbusZhAMiZyi77qimq5+SAJlz9aRme3cJbx:zMlBVnrAMiwMmTqeYnsJbx
                                                                                                                                                                                                                                                MD5:6FBEFDC3DEC612B7B2CC903D8C53F45B
                                                                                                                                                                                                                                                SHA1:14EC3C166DC411149C32C262DBE8E327F6186669
                                                                                                                                                                                                                                                SHA-256:3130BF26DA0C840C1E02203A90C3B1C38966FB203130E2FBB3DD7CB3865A3539
                                                                                                                                                                                                                                                SHA-512:F3F15AD8B6C9D9B4C9C994FE3235B4463E59BE7DCE79CF3F7AA77905D6F4DC2C4AABB79B440767DB13D357B13F09EA34983FCA7BC92D0AFA15FB6CBEDDD04E38
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-5, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0040104020403040404050406040704080409040A040B040C00AD040E040F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..044004410442044304

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-6.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):2.992219341429816
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:YHVBUlJvRj7SOVbusZhAMiZyi77qimEZjyG/KE:YMlBVnrAMiwMmTEs6KE
                                                                                                                                                                                                                                                MD5:52F025D943A45EE840D9C3DFD06E4D79
                                                                                                                                                                                                                                                SHA1:571EA14B49FA6150BFD2ABA79E52799955D9FA10
                                                                                                                                                                                                                                                SHA-256:CB71909BF01A3A7A4C7396359DA06D206B58A42AD68192CE37169D6640D46E13
                                                                                                                                                                                                                                                SHA-512:77FF9DC785A63CA59A7D58BB25C7D2C16F364E525F9B939177385EF80F7DE37734C8774F1BC829CF0270FD66257A4D31689654C8037DB0A86A0291FFDE637B90
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-6, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000000000000000A40000000000000000000000000000060C00AD00000000..00000000000000000000000000000000000000000000061B000000000000061F..0000062106220623062406250626062706280629062A062B062C062D062E062F..0630063106320633063406350636063706380639063A00000000000000000000..064006410642064306

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-7.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.393893260854861
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:TMyHVBUlJvRj7SOVbusZhAMiZyi77qim2OBHK9QQSqiWeIDDdn:TlMlBVnrAMiwMmT1hKyQSqiWeIVn
                                                                                                                                                                                                                                                MD5:4BFB0A35D971A9D4C5EA8D8099E93C37
                                                                                                                                                                                                                                                SHA1:8FED2CBB1343E5B4442748242B5F89A76110592D
                                                                                                                                                                                                                                                SHA-256:76F6BC85FC9CB89BC3F94D36275AB23C740BA17FD36EC8907479DA3A885415EA
                                                                                                                                                                                                                                                SHA-512:C9CE1E9EA57A1DEF62BBC60A115C06325C6EE8F92021695459E1ADAF1193A559BC5F0229191BFC2E344296DC137583ED4A9A61A65890F99F4CF97B3864C7AF0F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-7, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A02018201900A320AC20AF00A600A700A800A9037A00AB00AC00AD00002015..00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-8.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.0494739426493567
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:uHVBUlJvRj7SOVbusZhAMiZyi77qimieGlnvs26Kcv:uMlBVnrAMiwMmTirv87
                                                                                                                                                                                                                                                MD5:5F69EAF54E7A1E8AC81C9E734DBE90D8
                                                                                                                                                                                                                                                SHA1:BA509C88A4FC03922EF5CDC887FAA7B594A9BC5A
                                                                                                                                                                                                                                                SHA-256:865E3665743B5FABA3E1AD6AA55515A666BD05DA6266879D9B66C98905DAFF3C
                                                                                                                                                                                                                                                SHA-512:D9924FBE59CB571AF721CA602DBE58CAD0D9310610EDF544F8FC0FBF3D1CE4E99597D0198E4E7C802107012786346FE4C1B9C6C3A76D5F60B9A83981B0EDA24D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-8, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000002017..05D005D105D205D305

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\iso8859-9.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1114
                                                                                                                                                                                                                                                Entropy (8bit):3.2591070910715714
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:XHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkBSMH+tA/b:XMlBVnrAMiwMmTmokgzAD
                                                                                                                                                                                                                                                MD5:0B99E605E73B7D8DEFD8D643F5729748
                                                                                                                                                                                                                                                SHA1:F30E7CCBCD9C539126E8D6CA0886E4B2BD54E05D
                                                                                                                                                                                                                                                SHA-256:CF51E867DDE2F19553D98FEEC45A075C4B4F480FB1EDADB3D8DAD1EBEA9299F3
                                                                                                                                                                                                                                                SHA-512:DA0487CD7F2143195E80697C17FFDB61AFD464C888DDF84813B2B5D1BAB24D96466DA7A7F77C8E4A9D0D53F34D72928923380AFC1B92A96C0A3BFF46006A4E19
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: iso8859-9, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\jis0201.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1112
                                                                                                                                                                                                                                                Entropy (8bit):3.2708615484795676
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:zBHVBUlJvRj7SOVbusZhAMiZyi77qN8VmKfkiJt0RMFS:zBMlBVnrAMiwMmNPYPFS
                                                                                                                                                                                                                                                MD5:4E21F24F8D9CC5DF16B29CACD997AC69
                                                                                                                                                                                                                                                SHA1:064E723EFB82EF1C303E5267496304288821E404
                                                                                                                                                                                                                                                SHA-256:61B14A7C312366F79BB45F02C6B7EE362E6F51CBAD5E479E563C7F7E785DB654
                                                                                                                                                                                                                                                SHA-512:AF8FAEB47EFB51F2537139F7C4254ABED119E477FD2B5E83B90B7A903B43C4E02DDF43A7DDB044A0A9601E9F9ADE91B02EE7C0EC87FF5DDCF9951B9601A90435
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: jis0201, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..00000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\jis0208.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):81772
                                                                                                                                                                                                                                                Entropy (8bit):2.3571626869060776
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:AigXM6CwL/9pV7Hl6+Yko9gZxErA3/MS/8xqg8:AZ/tp1Hl2KZxUfr8
                                                                                                                                                                                                                                                MD5:F0661E22C7455994AA1F6EC1EDA401B4
                                                                                                                                                                                                                                                SHA1:928B2AC46A9FDE61A81F56BE225E6138B40C22E5
                                                                                                                                                                                                                                                SHA-256:F6B1C6AC5F5FC4E990A7A1AAC16A406012040936431BEFE7D2B6CD1DA9E422C4
                                                                                                                                                                                                                                                SHA-512:917CC58678A9E9F5CBE860D30828846ABA4EA8CDFAB7DD1AE6A66C47ECBB85CF67DD97BC3E6F95341DD30F4E757B2CEA571708D5B4CED18A29F19904C3138AE0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: jis0208, double-byte..D..2129 0 77..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8..FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F..FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D..FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7..00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5..FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\jis0212.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):72133
                                                                                                                                                                                                                                                Entropy (8bit):2.3455261548208055
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:9F/D7CH2puD5CdzU3nAkP5dHn7s391fmOarFaVQ:H/D7CHbozU3nAk3H7sXm3FgQ
                                                                                                                                                                                                                                                MD5:07CE2C135BE17DBAFA558AA5949A53DB
                                                                                                                                                                                                                                                SHA1:5D9DBEFCCB44E76C1A4E61360C6FCED8DCC8EF4D
                                                                                                                                                                                                                                                SHA-256:785CFC5F5D9CB06DB8061730AB0016A0F70D0B59F6787D2A3CBB8D5779C99706
                                                                                                                                                                                                                                                SHA-512:E954D7198D58ACEDEB4C8E5F466107767C3DA43763A5F6CDDFCF567226F9B22B4C2DE27564F28CD125D7F1BA7CB9C6DE6DEC4065EC2676572C793BE458FDDD9D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: jis0212, double-byte..D..2244 0 68..22..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000000000000000000000000000000000000000002D8..02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000..0000000000A100A600BF00000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000BA00AA00A900AE2122..00A4211600000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\koi8-r.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.531149521168141
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:KcJ5mHVBUlJvRj7SOVbusZhAMiZyi77qpSzIa9qVRS3YcEchJh3MAxSl:KmmMlBVnrAMiwMmAzIxVgBE6cAxQ
                                                                                                                                                                                                                                                MD5:96F54CC639ACA8E466FB8058144C9350
                                                                                                                                                                                                                                                SHA1:0B9530D6080F2BAACABD5AA0D48BFF316FCCEF64
                                                                                                                                                                                                                                                SHA-256:0E43244BFC4F33FACB844B9E00270A1A4C24DC59B8A9B95104E2D788BB2F59FD
                                                                                                                                                                                                                                                SHA-512:5B7859325E5E34C9D4558B1198795BB9C6A8EF783EB97193EA80BA76C38AFE9BDD1B526B77401DF5456B7A0E85E942191FFD4B4F2B9F0C8168A7093EE452802E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: koi8-r, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204512553255425552556255725582559255A255B255C255D255E..255F25602561040125622563256425652566256725682569256A256B256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\koi8-u.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.5076564572101714
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:K+HVBUlJvRj7SOVbusZhAMiZyi77qpSzIaU3dmVRS3YcEchJh3MAxSl:K+MlBVnrAMiwMmAzI/EVgBE6cAxQ
                                                                                                                                                                                                                                                MD5:4B755EF2288DFC4009759F8935479D68
                                                                                                                                                                                                                                                SHA1:C3BDF0D9DF316DE8919DAA4329275C5AA81D61B4
                                                                                                                                                                                                                                                SHA-256:ED04D5B977B8C8944D8760B713FF061292DA5634BCBB67CDFB1C3A6FF5378C81
                                                                                                                                                                                                                                                SHA-512:3F1E1CC47327054FB9C54157ED10514230F10BFCD4BD9FDAFA02D7B238137DC7442CA2661B0739D8EEA3181E187D3B639A2C8118A0DE272C96000908121B6CFB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: koi8-u, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204510454255404560457255725582559255A255B0491255D255E..255F25602561040104032563040604072566256725682569256A0490256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\ksc5601.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):94393
                                                                                                                                                                                                                                                Entropy (8bit):2.4104200953565513
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:XbjO7Uw6uKdosXRxps9a+ut/BmZPwkpT9A0T03o:XfO4ZBRxpV+4wPwKloo
                                                                                                                                                                                                                                                MD5:366C09E4A4CC10006E593F5B3F3461D7
                                                                                                                                                                                                                                                SHA1:A0DABFBEEB66E26FB342844EA41772D7A1D19C24
                                                                                                                                                                                                                                                SHA-256:9B27FE7E7054F36E279993F19E52E18AC03360D117AE80C42B4E984A97C590AA
                                                                                                                                                                                                                                                SHA-512:670F32D698C7992038E736D3AD40098D8589C0C5A1379E32A0F02A02FAF251B1312CAD131DDADC3F80B23A3821A91689F2E310309028BDDDF227D532EB505A20
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: ksc5601, double-byte..D..233F 0 89..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300200B72025202600A8300300AD20152225FF3C223C20182019..201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7..00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640..222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6..25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D..221D2235222B222C2208220B2286228722822283222A222922272228FFE20000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macCentEuro.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1116
                                                                                                                                                                                                                                                Entropy (8bit):3.4295694929963667
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8jHVBUlJvRj7SOVbusZhAMiZyi77qHVPJSf2FcVDu1LEe4qPPMl2J89:8jMlBVnrAMiwMmHEmJ4IMgi9
                                                                                                                                                                                                                                                MD5:10850BCFB943318284D6191494EBD7D5
                                                                                                                                                                                                                                                SHA1:237D5DDF7969A422991F17021244D13A2BB0DE92
                                                                                                                                                                                                                                                SHA-256:81ECA6840B87F2DEF9FCDD171A55C2D71A49386D88401CE927AE57D7DDD7AAAA
                                                                                                                                                                                                                                                SHA-512:D797781C228B70D2D83DB8ABA08F840CE49846C9473CC89A2E316900D9E08A63142E68AD9ABBB2EF67BF9F1D392772FAB36CCC09632022A1437AE27C11F2284F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macCentEuro, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179..017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC..202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E..012F012A22642265012B0136220222110142013B013C013D013E0139013A0145..0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C..20132014201C201D2018201900F725CA014D0154015501582039203A01590156..01570160201A201E

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macCroatian.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1116
                                                                                                                                                                                                                                                Entropy (8bit):3.3992482002374516
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8ULyHVBUlJvRj7SOVbusZhAMiZyi77qsTMdKxOZwwL+KR5D/jlJy6QWky:8ULyMlBVnrAMiwMmOsL+KR5DblE85
                                                                                                                                                                                                                                                MD5:A60FBDE33D13C732095713D1AB6713AB
                                                                                                                                                                                                                                                SHA1:4B0EB443F2D0E4B8DB7D0435F9311E5F9A625123
                                                                                                                                                                                                                                                SHA-256:BBE6F5EBB5EAB08C91DF7D524FAF39B03AA8B9F84C67ABA0553A84EC56668CB9
                                                                                                                                                                                                                                                SHA-512:3EEBA6BA3FCD875AFBD5DF41EDC21E872416A48D03343232904CC99CAF913045DAF7B1A1ACD0949EF794AD7B6C9AE8F93808423FFC4B67718E732B2FF5D9B6D7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macCroatian, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8..221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8..00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153..01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB..201300B7201A201E

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macCyrillic.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1116
                                                                                                                                                                                                                                                Entropy (8bit):3.4178221849964903
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8dHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJY:8dMlBVnrAMiwMm8Y6zUk+UVsJY
                                                                                                                                                                                                                                                MD5:C390D66441AC61CCF0A685CA5EE0BC1C
                                                                                                                                                                                                                                                SHA1:FCAE825B54400B9D736EF22A613E359E3F0FA6C2
                                                                                                                                                                                                                                                SHA-256:76EFE571ADDA7AED467F146CB0BD3A2351F2A720508EA0642C419F5347789CAA
                                                                                                                                                                                                                                                SHA-512:C891DB15E0F600965885DE6745EDD2A4E3A6A20CA30A9AAE89CBD8C429F8455C4AF7F2FC053FB3D730D8544AB6A6E78E769DB93DAD7B29868B746FA10373F021
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macCyrillic, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..0430043104320433

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macDingbats.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1116
                                                                                                                                                                                                                                                Entropy (8bit):3.870022681111701
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:87JMHkUlJvRjmf9RCsUBOdXsCbbNviANpkDP1XFAoE4xSF5HrBPkdn:87KvlA9RCs6CXrViANUP1XFA9eSvdPKn
                                                                                                                                                                                                                                                MD5:DCE78527E3A7B7CB1DE9EE5FAF12AFC6
                                                                                                                                                                                                                                                SHA1:20F4A3F4DB6B3422C04EBB6B21A568E4C173F9C1
                                                                                                                                                                                                                                                SHA-256:062E31D48DC33160999074E49205E08C3655DFF91C2C87F254522E6EBCE2DD96
                                                                                                                                                                                                                                                SHA-512:627F5FD2F12B341F2D7EE9032946FE057C4AC74D99687178CEA98B3E150307BB6AA2495B0FA46400760D467E2BF589BE31E998E25CE1D1E8465DA61F22047345
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macDingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A3

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macGreek.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1113
                                                                                                                                                                                                                                                Entropy (8bit):3.4954458011071323
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8dOHVBUlJvRj7SOVbusZhAMiZyi77qJlbaBMD2aSY5us36Ekp1ysOSU2imR:8kMlBVnrAMiwMm7aKPVusqx1ysOJjmR
                                                                                                                                                                                                                                                MD5:0CC92F685A4132BE4B030006670D81CE
                                                                                                                                                                                                                                                SHA1:13B1074A90055E9EA061A6206A9C004DA29967A9
                                                                                                                                                                                                                                                SHA-256:1AABE561B5C944ABD11C293D4ACAC0F3A4A5A9E84A0342D066F4E3E992348895
                                                                                                                                                                                                                                                SHA-512:E1AF3D47D681CD68B6063DEC1241631CABE86FE835232FA73D855AC74D0175540D46511282BE7198A67A37970A5D05CDECF55C10424ED9C1413C108F116094D9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macGreek, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8..00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC..2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7..039100B12264226500A503920395039603970399039A039C03A603AB03A803A9..03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153..20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F..03CD03B103B203C803B

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macIceland.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.3991839018654573
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8KHVBUlJvRj7SOVbusZhAMiZyi77qscqMVmOZmk/LYRldjY/g4JyMWG:8KMlBVnrAMiwMmzqi/LYRlYBEXG
                                                                                                                                                                                                                                                MD5:747ADBE54D6992467415E322326FA1B9
                                                                                                                                                                                                                                                SHA1:5E3967B5DDF3A6DBF07E90ED6B9B9C2F3F3F35FE
                                                                                                                                                                                                                                                SHA-256:6FD08CE6FBA521D51E8058DE5C2DBD6583B80306A8BE7D015361F76314E70A35
                                                                                                                                                                                                                                                SHA-512:A04B946993985BF1F8FBA3A7A9AD3838F43F8F27F69B1FB1015D9DC8612AAFCE24E30CBC1FCABBDFB359FD487D51F70F18DA0CDA4A87749A2C82309CEB054849
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macIceland, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE..00FD00B7201A201E2

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macJapan.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):48813
                                                                                                                                                                                                                                                Entropy (8bit):3.3767502114972077
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:K/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSJi:KVUidzJCurDGSk
                                                                                                                                                                                                                                                MD5:3DCD22325E0194AAD4959C939B1DE24D
                                                                                                                                                                                                                                                SHA1:ABEF1372FBDA83714CE29E015D9A198D4B37B21C
                                                                                                                                                                                                                                                SHA-256:47007D9EBF4D34C6CE3599E50AFC7C1CF8129B88994DE2C2A857C09003F9CD2B
                                                                                                                                                                                                                                                SHA-512:B8ADFD2315EA38E5F7D4DED219759380069AAB539F1B5AAA5626CE32428CBBEB5E8215AD8351E023BCF72FA4DC30AB40CF59D6D45E33B6D1A6B41BEBFD4BD4C2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macJapan, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macRoman.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1113
                                                                                                                                                                                                                                                Entropy (8bit):3.4060725247347516
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8THVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldjBpmg4JyMWG:8TMlBVnrAMiwMmOi/LYRlTsBEXG
                                                                                                                                                                                                                                                MD5:34691FADC788B85D98F63159640C7DD0
                                                                                                                                                                                                                                                SHA1:C8B3D084D3E831EFF6ECEF71B2029545F214C3D4
                                                                                                                                                                                                                                                SHA-256:C83D971D6BC0284EF323C197896E38C57A5FF44784E451EC2997EDA70C0DD85C
                                                                                                                                                                                                                                                SHA-512:77D5676F9B7AF7FD1D612A1C426889D8F2C0191887E180B78C4AA42202928A1B3078B76BD3C5F5ABB2A5CE1AE913E3CA6EFDE0483D2A2B0EFC173EF25EAE1D67
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macRoman, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02..202100B7201A201E203

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macRomania.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.412326247178521
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8tHVBUlJvRj7SOVbusZhAMiZyi77qsTMVZ5OZwYRldj/T9g4JyMWG:8tMlBVnrAMiwMmOA7YRlFT9BEXG
                                                                                                                                                                                                                                                MD5:04E25073BFB0019D8381B72F7B433F00
                                                                                                                                                                                                                                                SHA1:B63B0AD9F10A44B0DDD12A3BDBCDEB2992D6D385
                                                                                                                                                                                                                                                SHA-256:0B805DAF21D37D702617A8C72C7345F857695108D905FF378791F291CEA150F0
                                                                                                                                                                                                                                                SHA-512:0514EC054676C15C65B01B02747CDBAD79BC89FD1A24A17797A8729752FB748FEDBE920E7BBFF41A6DA4BA99002E3B8DB674D53E30485DC36F6BF737EAF11702
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macRomania, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E..221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163..202100B7201A201E2

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macThai.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1112
                                                                                                                                                                                                                                                Entropy (8bit):3.6062142626989004
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:88HVBUlJvRj7SOVbusZhAMiZyi77qqJipJwHmEU4AyqU+TpH:88MlBVnrAMiwMmqJ8Jf4AyqUe
                                                                                                                                                                                                                                                MD5:06DC6BA6E4A75CD7FF2D7A4248912C61
                                                                                                                                                                                                                                                SHA1:23FB16763A8F11EF48E805E4F453C2F812D48FC4
                                                                                                                                                                                                                                                SHA-256:A1802A2FEB01B255EC7C17425EEE4525372DF8CE226F4047D149172EB438F913
                                                                                                                                                                                                                                                SHA-512:41A487EC5C36C17B2746C5DC770882A836E6E75CF6A14C31595EB211022F0476BD3B953497C447F21554769F127C3A56E5B6EF8FB3C20A8AFF8C67E0CC94359D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macThai, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899..FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F..0E400E410E420E430E44

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macTurkish.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.422718883614008
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8QjHVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldD8g4JyS:88MlBVnrAMiwMmOi/LYRlWBES
                                                                                                                                                                                                                                                MD5:4EA94A0DB35BED2081A2CC9D627A8180
                                                                                                                                                                                                                                                SHA1:AB2AC3ADA19F3F656780FF876D5B536A8DCE92C6
                                                                                                                                                                                                                                                SHA-256:AFB66138EBE9B87D8B070FE3B6E7D1A05ED508571E9E5B166C3314069D59B4E4
                                                                                                                                                                                                                                                SHA-512:7888F560D3728732BE1B7DCE49ECB61F3399CEF11191F4116C891E1D147B2A90ED8FB4A5E7B51904A001C47750BD9EB1B15EA5BA5B4EC5D69CDE7704B69529AD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macTurkish, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F..202100B7201A201E2

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\macUkraine.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                                Entropy (8bit):3.4157626428238723
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:8TzHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJd:8PMlBVnrAMiwMm8Y6zUk+UVsJd
                                                                                                                                                                                                                                                MD5:A5B48D6F2678579CBE6EA094A4655071
                                                                                                                                                                                                                                                SHA1:A13A41D530B21CE8443AFD7E811286537C5BA9C7
                                                                                                                                                                                                                                                SHA-256:F7E11736C9FF30102B31EC72272754110193B347433F4B364921E8F131C92BF0
                                                                                                                                                                                                                                                SHA-512:612F9D528CE940B5CA9E67CB127013A104655207511F4CF39C8696A127E6A8F4867F5603DCFB78C25A55668C6EE70F2997A8D1626F6F1DD44B19260967F17097
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: macUkraine, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..04300431043204330

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\shiftjis.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):42552
                                                                                                                                                                                                                                                Entropy (8bit):3.5565924983274857
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:w/RPrUHiJrwWkyY/W2wHiwWnwWOORY+gutSX:wVUid5JCurDGSX
                                                                                                                                                                                                                                                MD5:EEB45AF9D7104872FE290D1EC18AB169
                                                                                                                                                                                                                                                SHA1:A80CF4EA46301F0B8B4F0BC306270D7103753871
                                                                                                                                                                                                                                                SHA-256:4A15ED210126BCDAE32543F60EB1A0677F985F32D49FCE923B9FAE8C5BCF3DA4
                                                                                                                                                                                                                                                SHA-512:C359042B04441AA50E536B23EEA0C6C7B2C1893DFB9CDB5459D3B46945D3BB50FD7A32A4F4E26A83622E76D3D2BB0DBBC3D1F3FB87AAF40520A243165B82AB34
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: shiftjis, multi-byte..M..003F 0 40..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086008700000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\symbol.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):3.73983895892791
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:SdHkUlJvRjvRV7ZQsoRmSds2AsSemxUs+Jw1Viv6ObTXyn:avlJV7ZQsoRmosGSPxU/JOm6wTXyn
                                                                                                                                                                                                                                                MD5:D59E748D863A5FAEF0CEEC2564E041A3
                                                                                                                                                                                                                                                SHA1:4FFF3BE37F50C090FFC581F1C7769E20281E90C3
                                                                                                                                                                                                                                                SHA-256:9660537A7B62996478555C6F57C1962C78FB3972F19370B2E395C44842818A1F
                                                                                                                                                                                                                                                SHA-512:BF8FD0CF1CC55564C46976F53F441B26819ADBA7AB7BB04FF3FF5A313366FC3049DF29A839CCCB05EDEF4A7ECBB49FFCA62518EDA90AF2D7781874A8435073AE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: symbol, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002122000023220300250026220D002800292217002B002C2212002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..22450391039203A70394039503A603930397039903D1039A039B039C039D039F..03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F..F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF..03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..000003D2203222642044221E0192266326662665266021942190219121922193..00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5..21352111211C21182297229522052229222A2283228722842282228622082209..2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3..22C42329F8E8F8E9F8EA2

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\encoding\tis-620.enc

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1112
                                                                                                                                                                                                                                                Entropy (8bit):3.0553142874336943
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:ZlHVBUlJvRj7SOVbusZhAMiZyi77qsDHmEU4AyqU+TWwdd:PMlBVnrAMiwMmss4AyqUSd
                                                                                                                                                                                                                                                MD5:467A67DE6809B796B914F5BFF98EF46D
                                                                                                                                                                                                                                                SHA1:C62418071A6C9CB0DCE3F67E130BFD2FB7AB0B58
                                                                                                                                                                                                                                                SHA-256:50B62381D6EDD4219F4292BFDC365954491B23360DE7C08033E7218A3D29C970
                                                                                                                                                                                                                                                SHA-512:BF98305AA7D759A087B9EABDC404714D8DC6B4F1BEED4ED0E1FFE646641E1AECA307673D64CF95FD09546D977B3409D6C04F56DCCA1D6332B0D9B6DD460B77A9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Encoding file: tis-620, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E44

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\history.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8235
                                                                                                                                                                                                                                                Entropy (8bit):4.855903177272536
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:Hf8PxPu7pUHBpqyzmY5rEk/fvs+AokFlTGHts1H/tsEGZPBtsLIVn++G:H6Pu7ELJTtyli8Ozz+L
                                                                                                                                                                                                                                                MD5:8609B624CD3EC63DD02DBF89455C3A9B
                                                                                                                                                                                                                                                SHA1:B3E1843E34C38AA668FFDDF435A1A65D55449CA0
                                                                                                                                                                                                                                                SHA-256:5123DB837EADF45712EA7D449BC40BFD3E8E16D3D71E7D0CE9A32F164973D767
                                                                                                                                                                                                                                                SHA-512:B20B75473F34209888F38EE570B8A96061760E88466DFC2EC55C814968DC7F67D92D255E8635188B60455B88F2D1D517747613AD0F366D60412D2D6ECE231B0E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# history.tcl --..#..# Implementation of the history command...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.....# The tcl::history array holds the history list and some additional..# bookkeeping variables...#..# nextid.the index used for the next history list item...# keep..the max size of the history list..# oldest.the index of the oldest item in the history.....namespace eval ::tcl {.. variable history.. if {![info exists history]} {...array set history {... nextid.0... keep.20... oldest.-20...}.. }.... namespace ensemble create -command ::tcl::history -map {...add.::tcl::HistAdd...change.::tcl::HistChange...clear.::tcl::HistClear...event.::tcl::HistEvent...info.::tcl::HistInfo...keep.::tcl::HistKeep...nextid.::tcl::HistNextID...redo.::tcl::HistRedo.. }..}.....# history --..#..#.This is the main history command. See the

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\http1.0\http.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10066
                                                                                                                                                                                                                                                Entropy (8bit):4.806771544139381
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd
                                                                                                                                                                                                                                                MD5:C2092F8CA2D761DFA8C461076D956374
                                                                                                                                                                                                                                                SHA1:90B4648B3BC81C30465B0BE83A5DB4127A1392FB
                                                                                                                                                                                                                                                SHA-256:8C474095A3ABA7DF5B488F3D35240D6DE729E57153980C2A898728B8C407A727
                                                                                                                                                                                                                                                SHA-512:09CE408886E2CEADDF70786A15D63AF9A930E70CAC4286AC9DDD2094C8EDCF97A2ADC2D3D2659B123F88719340D3B00D9F96E9BC7C8B55192735C290E7D24683
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# http.tcl..# Client-side HTTP for GET, POST, and HEAD commands...# These routines can be used in untrusted code that uses the Safesock..# security policy...# These procedures use a callback interface to avoid using vwait,..# which is not defined in the safe base...#..# See the http.n man page for documentation....package provide http 1.0....array set http {.. -accept */*.. -proxyhost {}.. -proxyport {}.. -useragent {Tcl http client package 1.0}.. -proxyfilter httpProxyRequired..}..proc http_config {args} {.. global http.. set options [lsort [array names http -*]].. set usage [join $options ", "].. if {[llength $args] == 0} {...set result {}...foreach name $options {... lappend result $name $http($name)...}...return $result.. }.. regsub -all -- - $options {} options.. set pat ^-([join $options |])$.. if {[llength $args] == 1} {...set flag [lindex $args 0]...if {[regexp -- $pat $flag]} {... return $http($flag)...} else {... return -code er

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\http1.0\pkgIndex.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):746
                                                                                                                                                                                                                                                Entropy (8bit):4.711041943572035
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:jHx5XRsLzhjJS42wbGlTULuUAZb3KykszLl7+HkuRz20JSv6C3l5kMn:bHRsRJS42wbGlTUcZ+yk2Lli1z2jxXkM
                                                                                                                                                                                                                                                MD5:A387908E2FE9D84704C2E47A7F6E9BC5
                                                                                                                                                                                                                                                SHA1:F3C08B3540033A54A59CB3B207E351303C9E29C6
                                                                                                                                                                                                                                                SHA-256:77265723959C092897C2449C5B7768CA72D0EFCD8C505BDDBB7A84F6AA401339
                                                                                                                                                                                                                                                SHA-512:7AC804D23E72E40E7B5532332B4A8D8446C6447BB79B4FE32402B13836079D348998EA0659802AB0065896D4F3C06F5866C6B0D90BF448F53E803D8C243BBC63
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Tcl package index file, version 1.0..# This file is generated by the "pkg_mkIndex" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}]..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\init.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):25633
                                                                                                                                                                                                                                                Entropy (8bit):4.885492991636381
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:cXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:hgGdKli4eonlm6offLzehNi
                                                                                                                                                                                                                                                MD5:FE92C81BB4ACDDA00761C695344D5F1E
                                                                                                                                                                                                                                                SHA1:A87E1516FBD1F9751EC590273925CBC5284B16BD
                                                                                                                                                                                                                                                SHA-256:7A103A85413988456C2AD615C879BBCB4D91435BCFBBE23393E0EB52B56AF6E2
                                                                                                                                                                                                                                                SHA-512:C983076E420614D12AB2A7342F6F74DD5DCDAD21C7C547F660E73B74B3BE487A560ABD73213DF3F58BE3D9DBD061A12D2956CA85A58D7B9D9E40D9FA6E6C25EB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# init.tcl --..#..# Default system startup file for Tcl-based applications. Defines..# "unknown" procedure and auto-load facilities...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2004 Kevin B. Kenny. All rights reserved...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# This test intentionally written in pre-7.5 Tcl..if {[info commands package] == ""} {.. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]"..}..package require -exact Tcl 8.6.13....# Compute the auto path to use in this interpreter...# The values on the path come from several locations:..#..# The environment variable TCLLIBPATH..#..# tcl_library, which is the directory containing this init.tcl script...# [t

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\af.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1038
                                                                                                                                                                                                                                                Entropy (8bit):4.10054496357204
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:4EnLB383Hcm0hH9BncmtR7tK9dUVxMmALfpKIdzVJLd3xfjTuLM+vzkHWZ6tH9H0:4aR838HH9ekCkMmEfpK2xx2jiWZ0VbY
                                                                                                                                                                                                                                                MD5:DA8BA1C3041998F5644382A329C3C867
                                                                                                                                                                                                                                                SHA1:CA0BD787A51AD9EDC02EDD679EEEEB3A2932E189
                                                                                                                                                                                                                                                SHA-256:A1EACA556BC0CFBD219376287C72D9DBBFAB76ECF9BF204FD02D40D341BAF7DA
                                                                                                                                                                                                                                                SHA-512:4F086396405FDFE7FBDA7614D143DE9DB41F75BDBD3DB18B1EE9517C3DCCED238DD240B4B64829FD04E50F602DBF371D42A321D04C4C48E4B8B2A067CA1BAF2E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Ma"\.. "Di"\.. "Wo"\.. "Do"\.. "Vr"\.. "Sa"].. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \.. "Sondag"\.. "Maandag"\.. "Dinsdag"\.. "Woensdag"\.. "Donderdag"\.. "Vrydag"\.. "Saterdag"].. ::msgcat::mcset af MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset af MONTHS_FULL [list \.. "Januarie"\.. "Februarie"\.. "Maart"\.. "April"\.. "Mei"\.. "Junie"\.. "Julie"\.. "Augustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""].. ::msgcat::mcset af AM "VM

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\af_za.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.925537696653838
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xouFygMouFqF3v6ay/5ouFy9+3vR6HyFvn:4EnLB383RAgeYF3v6ay/RAI3voSVn
                                                                                                                                                                                                                                                MD5:1B9DCD1C6FCDDC95AE820EA8DA5E15B8
                                                                                                                                                                                                                                                SHA1:E8160353FD415BAB9FD5ACCA14E087C5E6AE836E
                                                                                                                                                                                                                                                SHA-256:1548988458BBF0DFCCC23B7487CEC0E9C64E4CC8E045723E50BEC37C454A8C81
                                                                                                                                                                                                                                                SHA-512:532AF060B95AED5E381B161BE56BC88D91A8F3DF2ACFD835491991F99FE752ADB4A3F93AB6D4E68F7042C28A3C1DD87A6312DFD9FFFAFD6ECE3F1B76837C5B7F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y".. ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ar.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2018
                                                                                                                                                                                                                                                Entropy (8bit):4.477377447232708
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83gr/fsS/Sm8p4M/n1KsPktE30AiJcAxi9CEzdEvSCHvMSV:43UkiSm8p3nX0EzdCSCPV
                                                                                                                                                                                                                                                MD5:D264D01B46D96455715114CAEDF9F05E
                                                                                                                                                                                                                                                SHA1:A3F68A4C6E69433BD53E52B73041575F3B3AC3F2
                                                                                                                                                                                                                                                SHA-256:B69D0061A728D59F89FF8621312789CD9F540BF2E2ED297804D22F6278561D85
                                                                                                                                                                                                                                                SHA-512:A4163DAA6821B293EADD5D499E0641A8B7C93180C710D6B364AE8681A8FF6F35EC948C8DDBE960A8466AF1ACABC15B0D465A08B084617E8005D708459F7E74D3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \.. "\u062d"\.. "\u0646"\.. "\u062b"\.. "\u0631"\.. "\u062e"\.. "\u062c"\.. "\u0633"].. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar MONTHS_ABBREV [list \.. "\u064a\u0646\u0627"\.. "\u0641\u0628\u0631"\.. "\u0645\u0627\u0631"\.. "\u0623\u0628\u0631"\.. "\u0645\u0627\u064a"\.. "\u064a\u0648\u0646"\.. "\u064a\u0648\u0644"\.. "\u0623\u063a\u0633"\.. "\u0633\u0628\u062a"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ar_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):265
                                                                                                                                                                                                                                                Entropy (8bit):4.872222510420193
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoKNvfcoKU3v6xyFjoKNo+3vfXM68vn:4EnLB3831vfD3v6g9F3vfc6+n
                                                                                                                                                                                                                                                MD5:430498B4AB1E77C86BC1311A49747581
                                                                                                                                                                                                                                                SHA1:684EAD965D9010C2A6E73DCACB2224FDE585F9FF
                                                                                                                                                                                                                                                SHA-256:2E04B96DA002519D28125918A22FF2BB9659A668A7BCAD34D85DDDECEC8DC0B4
                                                                                                                                                                                                                                                SHA-512:9F85A88A383DCFC54DAA6253D94C307A14B1CC91D5C97AF817B8122AF98025AB2430D0B2D656EBED09E78FB854D1F9CF99F3B791A6ECB7834112012739140126
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y".. ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ar_jo.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1851
                                                                                                                                                                                                                                                Entropy (8bit):4.08645484776227
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83sxS/Sm819+es/Ii/R91bpH0+U0c+es/Ii/R91bpH0+UO:43wiSm815MbJbHgMbJbp
                                                                                                                                                                                                                                                MD5:5C62D606F4F14BC8994B28F9622D70DD
                                                                                                                                                                                                                                                SHA1:E99F8CC5D330085545B05B69213E9D011D436990
                                                                                                                                                                                                                                                SHA-256:5ADBB3D37C3369E5FC80D6A462C82598D5A22FAEF0E8DF6B3148231D2C6A7F73
                                                                                                                                                                                                                                                SHA-512:81AC9200459B0896E27A028BD089A174F7F921B0367BC8FF1AB33D3E561417B6F8EC23DAB750ECB408AC8A11CDFDBFA4F890F9E723BB8607B017C9FEE00928A0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ar_lb.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1851
                                                                                                                                                                                                                                                Entropy (8bit):4.083347689510237
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83LxS/Sm8S9+es/Ii/R91bpH0+U/c+es/Ii/R91bpH0+UO:431iSm8S5MbJbQgMbJbp
                                                                                                                                                                                                                                                MD5:6FC1CC738207E2F8E0871103841BC0D4
                                                                                                                                                                                                                                                SHA1:D2C62C7F6DA1EF399FCBE2BA91C9562C87E6152F
                                                                                                                                                                                                                                                SHA-256:1FC13070CF661488E90FECE84274C46B1F4CC7E1565EAB8F829CCAA65108DFCA
                                                                                                                                                                                                                                                SHA-512:E547D5CBB746654051AFDA21942075BC2224C2FF75D440C6C34C642AD24CF622E520FF919B8BD4AFC0116D9CE69B3ABA4E81EE247C1388F3C5741150201F5C60
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ar_sy.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1851
                                                                                                                                                                                                                                                Entropy (8bit):4.084701680556524
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83lxS/Sm8M9+es/Ii/R91bpH0+UBc+es/Iv/I91bpH0+UO:43LiSm8M5MbJbSgMo0bp
                                                                                                                                                                                                                                                MD5:8188C37CA44FEFFF8D895AAD503AD4F6
                                                                                                                                                                                                                                                SHA1:C48F2E3B9FC055704D2DAFDC67E9D08EE6897D45
                                                                                                                                                                                                                                                SHA-256:294F3E46C55453EDAD44567E1330F9B43E69A07FA0655B24DD2780A4490C1194
                                                                                                                                                                                                                                                SHA-512:F86FCFC7C460473D46C472041AB2E1F9388CF34BCA9050295D1DAE454E35A2A0320D0C61D5E8CBB832AF74FFDD1A7511AF32EA2A53B481F39A1CBCF5F086D514
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\be.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2157
                                                                                                                                                                                                                                                Entropy (8bit):4.27810535662921
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:43PI8IKQGQ8mA/XxQJxQnA9QJlPyI/tbCaQICMIcQ8InVI5tNIzQFIQQLtChjsI4:2PItK5BSb9ajfycCW5IzdQNxK
                                                                                                                                                                                                                                                MD5:6334BDDFC1E0EAE4DBB2C90F85818FD8
                                                                                                                                                                                                                                                SHA1:085EDC3D027D6B5A6A6A2561717EA89C8F8B8B39
                                                                                                                                                                                                                                                SHA-256:A636A82C7D00CCDC0AF2496043FFA320F17B0D48A1232708810D3BB1453E881E
                                                                                                                                                                                                                                                SHA-512:18ADB77314FCFD534E55B234B3A53A0BC572AB60B80D099D2F3B20E0C5FE66179FDC076AA43200DB3CA123BC6216989EC41448FA624D3BA9633413AD8AD6034C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0430\u0442"\.. "\u0441\u0440"\.. "\u0447\u0446"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \.. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\.. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\.. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\.. "\u0441\u0435\u0440\u0430\u0434\u0430"\.. "\u0447\u0430\u0446\u0432\u0435\u0440"\.. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset be MONTHS_ABBREV [list \.. "\u0441\u0442\u0434"\.. "\u043b\u044e\u0442"\.. "\u0441\u043a\u0432"\.. "\u043a\u0440\u0441"\.. "\u043c\u0430\u0439"\.. "\u0447\u0440\u0432"\.. "\u043b\u043f\u043d"

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\bg.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1871
                                                                                                                                                                                                                                                Entropy (8bit):4.4251657008559935
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:43EUAIlnQf/QVdQ81mnEZqEavWQEQ3QvQrQL0QjQTtQDCQSY4tqP:27xMk+nEZqE3biIYbUi+C9y
                                                                                                                                                                                                                                                MD5:E5225D6478C60E2502D18698BB917677
                                                                                                                                                                                                                                                SHA1:52D611CB5351FB873D2535246B3A3C1A37094023
                                                                                                                                                                                                                                                SHA-256:CFE4E44A3A751F113847667EC9EA741E762BBDE0D4284822CB337DF0F92C1ACA
                                                                                                                                                                                                                                                SHA-512:59AB167177101088057BF4EE0F70262987A2177ECB72C613CCAAE2F3E8D8B77F07D15DA5BE3B8728E23C31A1C9736030AA4036A8CD00A24791751A298B3A88B3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0434"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u043b\u044f"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0421\u0440\u044f\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\.. "\u041f\u0435\u0442\u044a\u043a"\.. "\u0421\u044a\u0431\u043e\u0442\u0430"].. ::msgcat::mcset bg MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset bg MO

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\bn.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2335
                                                                                                                                                                                                                                                Entropy (8bit):4.107102006297273
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR835e/MWrD//6HFEVcVVcCVcTUTVckVEVcT7VcEEVcby/Vcn0VcMr/0VcM8VcQ:43ktX++QalMObalMZ6IE6V
                                                                                                                                                                                                                                                MD5:5D25E7FC65824AC987535FEA14A4045C
                                                                                                                                                                                                                                                SHA1:85C10F05823CD3263FC7B3EC38796BEC261B3716
                                                                                                                                                                                                                                                SHA-256:890EA6521DEB1B3C3913CCD92562F6360E064DAEE2E2B0356A6DD97A46264A1F
                                                                                                                                                                                                                                                SHA-512:5D8A88ACAEBBF3CD721F288FA0F1FEE517EE568CA5482E30CFA1E36CD37DF011C449090E2D9041F1D046A191F13D4C5C4B6F9E2F16FD259E63CE46ECC4E4F81F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \.. "\u09b0\u09ac\u09bf"\.. "\u09b8\u09cb\u09ae"\.. "\u09ae\u0999\u0997\u09b2"\.. "\u09ac\u09c1\u09a7"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\.. "\u09b6\u09c1\u0995\u09cd\u09b0"\.. "\u09b6\u09a8\u09bf"].. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \.. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\.. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\.. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\.. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\.. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\.. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"].. ::msgcat::mcset bn MONTHS_ABBREV [list \.. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\.. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\bn_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):265
                                                                                                                                                                                                                                                Entropy (8bit):4.868201122972066
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xovtvfluo/E3v6xyFjovto+3vflm68vn:4EnLB383UtvfltE3v6g8tF3vflm6+n
                                                                                                                                                                                                                                                MD5:B91BB2ABC23B90962D2070B9588F2AB5
                                                                                                                                                                                                                                                SHA1:CBB4E9CD600773792C6E9F3E6B27E99C1846B44F
                                                                                                                                                                                                                                                SHA-256:B3D8A4632290B0F3DA690E47C1FDF06A8B9E171A96E938AFDB0DD52CF806CE54
                                                                                                                                                                                                                                                SHA-512:932FC4B8C3CA72731187D56012AD7DD7777C4D447F16EEB17B9D68235C9590DF99992FD22B8D7C85A843A610F93CD36FAFA993C34C441255A1C0A93C73BC5FE4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ca.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1152
                                                                                                                                                                                                                                                Entropy (8bit):4.2880653012847985
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83FMVBNfPg+g+RjMu5+C6MB4zdiwvWvn:432g6jh65zd3gn
                                                                                                                                                                                                                                                MD5:72DDD60C907DD235BCE4AB0A5AEE902C
                                                                                                                                                                                                                                                SHA1:06150F793251687E6FBC3FDA3BC81BCBFC7DE763
                                                                                                                                                                                                                                                SHA-256:3BE295DCC8FCDC767FED0C68E3867359C18E7E57D7DB6C07236B5BC572AD328E
                                                                                                                                                                                                                                                SHA-512:3B0A85003692F1E46185D5CC09236D2DA5E6D29166C9812D07A7D6BF6AC6C3B0708F91C6899768D4DBA3528081B8B43E09F49622B70F1CF991AFAC5352B6BA37
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \.. "dg."\.. "dl."\.. "dt."\.. "dc."\.. "dj."\.. "dv."\.. "ds."].. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \.. "diumenge"\.. "dilluns"\.. "dimarts"\.. "dimecres"\.. "dijous"\.. "divendres"\.. "dissabte"].. ::msgcat::mcset ca MONTHS_ABBREV [list \.. "gen."\.. "feb."\.. "mar\u00e7"\.. "abr."\.. "maig"\.. "juny"\.. "jul."\.. "ag."\.. "set."\.. "oct."\.. "nov."\.. "des."\.. ""].. ::msgcat::mcset ca MONTHS_FULL [list \.. "gener"\.. "febrer"\.. "mar\u00e7"\.. "abril"\.. "maig"\.. "juny"\.. "juliol"\.. "agost"\.. "setembre"\.. "octubre"\.. "novembre"\.. "desembre"\.. ""].. ::msg

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\cs.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1354
                                                                                                                                                                                                                                                Entropy (8bit):4.466447248030554
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83U4nZ4yJTkkG3mYWEZqO1R3DNBEVG+PYhxrU4UF3ecCvt7/v3e6:43TJTGmnEZqE5/EVEDOGtDp
                                                                                                                                                                                                                                                MD5:F32EAD82CC26754C5A8E092873A28DB3
                                                                                                                                                                                                                                                SHA1:325124660F62242B24623B4B737CB4616F86CFF3
                                                                                                                                                                                                                                                SHA-256:AFEA12A16A6FA750EA610245133B90F178BA714848F89AEC37429A3E7B06BE1A
                                                                                                                                                                                                                                                SHA-512:04E335AAFBF4D169983635FC87BCFFE86FBA570A3E1820D20240EF7B47E7A3CD94AE3598543DCE92A1F82B5146CAAD982EFE9490EFD9E581D58515CFC3930581
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "\u00dat"\.. "St"\.. "\u010ct"\.. "P\u00e1"\.. "So"].. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \.. "Ned\u011ble"\.. "Pond\u011bl\u00ed"\.. "\u00dater\u00fd"\.. "St\u0159eda"\.. "\u010ctvrtek"\.. "P\u00e1tek"\.. "Sobota"].. ::msgcat::mcset cs MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset cs MONTHS_FULL [list \.. "leden"\.. "\u00fanor"\.. "b\u0159ezen"\.. "duben"\.. "kv\u011bten"\.. "\u010derven"\.. "\u010dervenec"\.. "srpen"\.. "z\u00e1\u0159\u00ed"\.. "\u0159\u00edjen"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\da.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1208
                                                                                                                                                                                                                                                Entropy (8bit):4.315504392809956
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83wV0tBVYuorIsmZ5meAxyISjTHU92WFVwpwvbvT:43w+DiuorreAY0zw8rT
                                                                                                                                                                                                                                                MD5:27A6A8BE8903AEF9D0BE956906A89583
                                                                                                                                                                                                                                                SHA1:EE29FDF67CB3AE150DF6BBBE603C1C3F5DA28641
                                                                                                                                                                                                                                                SHA-256:0D422A991BCA13FE9033118691CFEDAB0F372222EBB0BC92BAF8E914EE816B84
                                                                                                                                                                                                                                                SHA-512:0E702A679AD94BF479226B7DE32077562F3F95210F6453AE564138386DBB179941BA5359AEE9AC532F4A6E5BE745D6962D6B638A21DD48B865716F2FD2A0CB01
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset da MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset da MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marts"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset da B

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\de.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1276
                                                                                                                                                                                                                                                Entropy (8bit):4.349293509679722
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83cFNSsZKKgXum47fpK2OaSIui7dHqWZ0ZIBFJWJvvvWIn:43InZKKgXoOqx1W67W9XWIn
                                                                                                                                                                                                                                                MD5:EE3963A5F7E29C05C9617BE3FD897114
                                                                                                                                                                                                                                                SHA1:0F978CA174DF596817F872B5EF1B447B9DFE651C
                                                                                                                                                                                                                                                SHA-256:4C27733502066E8391654D1D372F92BF0484C5A3821E121AE8AA5B99378C99AE
                                                                                                                                                                                                                                                SHA-512:EA933709C68F8199858A1CC1FFDA67EE7458CC57A163E672535EB0B4C37BFDC200604C7506748DAC3158B6CA63C2F076A2C6252B2A596E59F83D3B1D4BC9C901
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Mo"\.. "Di"\.. "Mi"\.. "Do"\.. "Fr"\.. "Sa"].. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mrz"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de BCE "v.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\de_at.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):847
                                                                                                                                                                                                                                                Entropy (8bit):4.412930056658995
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR831sMm47fpK2++SIui7dHqWZ0ZItovGvzvW:431h+mx1Wm+QjW
                                                                                                                                                                                                                                                MD5:A6227CD4F7434952D093F1F3C64B4378
                                                                                                                                                                                                                                                SHA1:0DDB9A49CB83DDF2396B2ECA85093260710496C2
                                                                                                                                                                                                                                                SHA-256:1C02D14140196623297F858E2EEF00B4159E1C6FAFE044EC65A48C9C24D46540
                                                                                                                                                                                                                                                SHA-512:D63F34024356F5CE0335D14EA557F4BBF238CCA8265DD27C039C70F7F28FE737F368B030DEE10B2C536512D2815E1F5B19838D08745C6A76A39050D573597EB3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_AT MONTHS_ABBREV [list \.. "J\u00e4n"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_AT MONTHS_FULL [list \.. "J\u00e4nner"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset de_AT TIME_FORMAT "%T".. ::msgcat::mcset de_AT TIME_FORMAT_12 "%T".. ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\de_be.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1276
                                                                                                                                                                                                                                                Entropy (8bit):4.389082225723362
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83B8VSysVB8VsZKKgJ5Mm47fpK26aSIui7dHqWZ0ZIlj5VevjevbDvW:43Bt1VBbZKKgJs6qx1Wc5VojobzW
                                                                                                                                                                                                                                                MD5:C351057D8E5328C0790901D1F4DBEC9F
                                                                                                                                                                                                                                                SHA1:F73DE8AEF7F8083B0726760AA003E81067A68588
                                                                                                                                                                                                                                                SHA-256:532845CD15EC821C1939D000C648694A64E8CA8F0C14BAD5D79682CF991481CE
                                                                                                                                                                                                                                                SHA-512:8152AD082D0A6A4EBE7E1CCA9D4A5F2E48ABE3F09F4385A517C523A67CA3B08E0F20C193D0F6850F37E55ED0CD6FBD201FE22CC824AF170976D04DB061212F2D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \.. "Son"\.. "Mon"\.. "Die"\.. "Mit"\.. "Don"\.. "Fre"\.. "Sam"].. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de_BE MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_BE MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::m

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\el.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2304
                                                                                                                                                                                                                                                Entropy (8bit):4.371322909589862
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR833v+ZYYWtv+nWfFyL1NYOg+EKVJQ19tWQYmYaYRn9sWuSAJIJ6eRa6WrmdlX:43/pZyLjY0uYR9QmdkjC9r
                                                                                                                                                                                                                                                MD5:7DD14B1F4FF532DCAF6D4C6F0DF82E9A
                                                                                                                                                                                                                                                SHA1:707875FEF4207EBB71D066FDC54C7F68560C6DAD
                                                                                                                                                                                                                                                SHA-256:8B23E0E2F0F319BB9A2DFDCCDC565FF79A62FA85094811189B6BC41594232B6B
                                                                                                                                                                                                                                                SHA-512:5ECA072DE5DD7890270AE268C7C8D40EE2DB6966643604D16E54194DB0AD74FDA8D04848331E61B387E8B494AF18252E38671D939069EC4C90C672A629563B88
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \.. "\u039a\u03c5\u03c1"\.. "\u0394\u03b5\u03c5"\.. "\u03a4\u03c1\u03b9"\.. "\u03a4\u03b5\u03c4"\.. "\u03a0\u03b5\u03bc"\.. "\u03a0\u03b1\u03c1"\.. "\u03a3\u03b1\u03b2"].. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \.. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\.. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\.. "\u03a4\u03c1\u03af\u03c4\u03b7"\.. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\.. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\.. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\.. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"].. ::msgcat::mcset el MONTHS_ABBREV [list \.. "\u0399\u03b1\u03bd"\.. "\u03a6\u03b5\u03b2"\.. "\u039c\u03b1\u03c1"\.. "\u0391\u03c0\u03c1"\.. "\u039c\u03b1\u03ca"\.. "\u0399\u03bf\u

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_au.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):307
                                                                                                                                                                                                                                                Entropy (8bit):4.896073290907262
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoCwmGjbmvFjoCws6W3v1oCws6W3v6p6HyFjoCwmT+3vjbe:4EnLB383QrmdSs6W3vss6W3v6QSoJ3ve
                                                                                                                                                                                                                                                MD5:5B31AD8AC0000B01C4BD04BF6FC4784C
                                                                                                                                                                                                                                                SHA1:F55145B473DDCAE38A0F7297D58B80B12B2A5271
                                                                                                                                                                                                                                                SHA-256:705C66C14B6DE682EC7408EABDBA0800C626629E64458971BC8A4CBD3D5DB111
                                                                                                                                                                                                                                                SHA-512:1CCE6BCAE5D1F7D80E10687F0BCA2AE1B2DD53F04A0F443DC9B552804D60E708E64326B62BA4E3787325D89837B4AC8CCCA9AF6F39CBD654BCC8A9C27EA63BB8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_be.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):312
                                                                                                                                                                                                                                                Entropy (8bit):4.870560620756039
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoCr3FuoCsX3vtfNrsoCsX3v6YNIdjoCs+3v3FnN9vn:4EnLB383H3Fb3vtNN3v6y43v3FnNNn
                                                                                                                                                                                                                                                MD5:DDA87ACED97F9F7771788A1A0A1E4433
                                                                                                                                                                                                                                                SHA1:E221653CD659C095098180344654770FF059331B
                                                                                                                                                                                                                                                SHA-256:BC87754A253C1036E423FA553DA182DBC56F62A13EDA811D8CD9E8AFA40404A6
                                                                                                                                                                                                                                                SHA-512:BB95D9241B05686CA15C413746DD06071635CB070F38847BE9702397A86C01A3D54DEBE1ACAA51834AB74DB8D0F75E353995183864E382721425756EE46B0B1E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z".. ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_bw.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.915769170926952
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xosmGMoss6W3v6ay/5osmT+3vR6HyFvn:4EnLB383hr8s6W3v6ay/hJ3voSVn
                                                                                                                                                                                                                                                MD5:4CBF90CE15ECCB6B695AA78D7D659454
                                                                                                                                                                                                                                                SHA1:30C26ADB03978C5E7288B964A14B692813D6E0B8
                                                                                                                                                                                                                                                SHA-256:EC48F18995D46F82B1CC71EA285174505A50E3BA2017BCCE2D807149B7543FD0
                                                                                                                                                                                                                                                SHA-512:CC809EBD1B2B5D9E918C2E2CE4E7075DFB0744C583F17C1C234D8437EF0C34654D2F09FF77544AD3430CEC78ABC70AA5F85F71AD1489A687B8087FCDFE07B088
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_ca.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):295
                                                                                                                                                                                                                                                Entropy (8bit):4.87629705076992
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoAhgqyFjoAZF3vX5oAZF3v6cvBoAh9+3vnFDL8vn:4EnLB383FhgqWDZF3vVZF3v6cvdhI3vM
                                                                                                                                                                                                                                                MD5:BFC4A48F5B10D137A4D32B440C47D3C6
                                                                                                                                                                                                                                                SHA1:C90EF2A8291DE589BC12D0A5B8AF2F0B00FEB7CD
                                                                                                                                                                                                                                                SHA-256:3CF2D0937FD95264549CF5C768B898F01D4875A3EB4A85D457D758BC11DFEC6E
                                                                                                                                                                                                                                                SHA-512:A91B81A956A438CA7274491CA107A2647CBDFB8AEB5FD7A58238F315590C74F83F2EBA4AA5C4E9A4A54F1FC1636318E94E5E4BBEA467326E0EACED079741E640
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_CA TIME_FORMAT "%r".. ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p".. ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_gb.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.892405843607203
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoEbtvqyFjoELE3vLjoELE3v6mjoEbto+3vnFDoAkvn:4EnLB383BbtvqWHLE3vTLE3v6EbtF3vW
                                                                                                                                                                                                                                                MD5:52E55DE8C489265064A01CEEC823DCDD
                                                                                                                                                                                                                                                SHA1:16F314A56AE0EAC9DAD58ADDEA6B25813A5BAA05
                                                                                                                                                                                                                                                SHA-256:C2CE5B74F9E9C190B21C5DF4106303B7B794481228FB9A57065B9C822A1059C3
                                                                                                                                                                                                                                                SHA-512:6010F29BF75D0CB4EE4F10781423A8CC68D5018DE8C633CD1217A7FE1299A0532E8C0E5D120188B748171EB255C587BB0B64B7384A58F725F3B6A4B9EA04393E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_GB TIME_FORMAT "%T".. ::msgcat::mcset en_GB TIME_FORMAT_12 "%T".. ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_hk.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):329
                                                                                                                                                                                                                                                Entropy (8bit):4.851471679101967
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoa+joaQ9PoaAx/G4soaYYW3v6ay/5oaAx/T+3v4x6HyFvn:4EnLB383BSiF4KxW3v6ay/B/3v4ISVn
                                                                                                                                                                                                                                                MD5:DE2A484508615D7C1377522AFF03E16C
                                                                                                                                                                                                                                                SHA1:C27C0D10E7667AD95FFF731B4E45B2C6E665CC36
                                                                                                                                                                                                                                                SHA-256:563450A38DB6C6A1911BC04F4F55B816910B3E768B1465A69F9B3BD27292DBEE
                                                                                                                                                                                                                                                SHA-512:A360B0FD7E36BCC0FB4603D622C36199E5D4C705396C6701F29730EB5CB33D81B208541CADFAED5303FC329C7C6A465D23CA9584F0DEC2DE128E258478DD6661
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_HK AM "AM".. ::msgcat::mcset en_HK PM "PM".. ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_ie.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.833246107458447
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoK6qyFjoKi+3vLjoKi+3v6mjoKv+3vnFDoAkvn:4EnLB383CqW13vJ3v6b3v9dmn
                                                                                                                                                                                                                                                MD5:57F0BBE1316D14BC41D0858902A7980A
                                                                                                                                                                                                                                                SHA1:B68BF99A021B9F01FE69341DF06F5D1453156A97
                                                                                                                                                                                                                                                SHA-256:9E0DCEE86A03B7BDD831E0008868A9B874C506315BF01DF3982AD3813FD3BA8E
                                                                                                                                                                                                                                                SHA-512:864F32254AAD39859AFC47D0C90DC5F38CA86EF0BBC7DE61BE253756C22B7806E616B59802C4F4D7B2F5543BF7C070FFF6FAF253E0A337EC443337E63A2E5A57
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_IE TIME_FORMAT "%T".. ::msgcat::mcset en_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):318
                                                                                                                                                                                                                                                Entropy (8bit):4.80637980762728
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoKr3ujoKrGtoKr5vMoKrw3v1oKr5o+3voAsvn:4EnLB383T9xvT3vJF3vonn
                                                                                                                                                                                                                                                MD5:1A54E506E70B2125C6016B373D3DD074
                                                                                                                                                                                                                                                SHA1:15289902BAA93208D8FB224E119166D0E044E34E
                                                                                                                                                                                                                                                SHA-256:ADEA3A1AB8AA84237DDB2F276ABDB96DCB4C51932E920D1A5E336904E1138664
                                                                                                                                                                                                                                                SHA-512:0D663233E6C96515713B3B829B605E72D8CE581AEF1C02FF6CA96598C040DCA42A3AC765EE9B5002E8969A331EB19A9AF0F8215F7113D0AD2F2EB2C560239D53
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IN AM "AM".. ::msgcat::mcset en_IN PM "PM".. ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_nz.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):307
                                                                                                                                                                                                                                                Entropy (8bit):4.939458132662909
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoyejbmvFjo63v1o63v6p6HyFjoy7+3vjb0ysvn:4EnLB383temdj3vd3v6QS1S3ven
                                                                                                                                                                                                                                                MD5:7E81708F107658FFD31C3BFBF704A488
                                                                                                                                                                                                                                                SHA1:7941ED040707591B68581337F8D90FA03C5E1406
                                                                                                                                                                                                                                                SHA-256:EC305B7CB393421E6826D8F4FEA749D3902EBA53BFA488F2B463412F4070B9ED
                                                                                                                                                                                                                                                SHA-512:8F038FF960F81D96FF9E3454D8ABDA7FFDA5B99DA304ACECC42E74DDBED839388246F66B58928DA902D3B475FBA46602B34F6829A87ECB1124FFC47C036B4DBE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_ph.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):329
                                                                                                                                                                                                                                                Entropy (8bit):4.824360175945298
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoojoOo2e4soe3v6ay/5o27+3v4x6HyFvn:4EnLB38304u3v6ay/k3v4ISVn
                                                                                                                                                                                                                                                MD5:E2E3BD806C20D7FB88109B7F3B84C072
                                                                                                                                                                                                                                                SHA1:2D7AD6BECA9C4D611BAE9747AD55A3E9385C2B42
                                                                                                                                                                                                                                                SHA-256:3A9C22B07906544C04F7A29B800FCE87C09D7FDF5C251236925115CF251A3890
                                                                                                                                                                                                                                                SHA-512:B14756B59BCABF8B29B41AC688E4F3A011735AF190B88F88B7B5FDDD3DA77F63FFC0F7875B3B453729CD3BC65E79F75F6E632CA68952EF473F78337D89E80BF2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_PH AM "AM".. ::msgcat::mcset en_PH PM "PM".. ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_sg.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.911413468674953
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoQW53FuoQGuX3v6ZwoQWa+3v3F0fxvn:4EnLB383V83FOJ3v62c3v3FEn
                                                                                                                                                                                                                                                MD5:F70245D73BE985091459ADF74B089EBC
                                                                                                                                                                                                                                                SHA1:21D52C336C08526D9DCF1AEC1F0701CB8B073D7A
                                                                                                                                                                                                                                                SHA-256:D565679AE9AACBFE3B5273FE29BD46F46FFBB63C837D7925C11356D267F5FF82
                                                                                                                                                                                                                                                SHA-512:171C70EB10D5E6421A55CE9B1AE99763E23FB6A6F563F69FE099D07C07FCA0CF8D3F6F00C5BB38BFF59A5F4C311506C4A9593F86C12B3B9E1861E72656B3800B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_za.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):251
                                                                                                                                                                                                                                                Entropy (8bit):4.937431055623088
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoOr0lIZoOK3v6poOs+3v0l6Uvn:4EnLB383z+3v6R3vl2n
                                                                                                                                                                                                                                                MD5:FCA7B13CA6C9527D396A95BEA94CC92D
                                                                                                                                                                                                                                                SHA1:E6F338A08F72DA11B97F70518D1565E6EF9AD798
                                                                                                                                                                                                                                                SHA-256:67C253E2A187AA814809418E5B7A21F3A1F9FB5073458A59D80290F58C6C1EB4
                                                                                                                                                                                                                                                SHA-512:37B8B4EA24B1C77AF0252A17660650CB2D4F8BB55C75817D6A94E1B81A3DDEF9913D12D3BF80C7BFE524CD0AD84E353E73238056759E6545BFE69EF5F806B8B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d".. ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S".. ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\en_zw.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.934659260313229
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoEmGMoEs6W3v6ay/5oEmT+3vR6HyFvn:4EnLB383Zr0s6W3v6ay/ZJ3voSVn
                                                                                                                                                                                                                                                MD5:A302091F490344B7A79C9463480AD7CF
                                                                                                                                                                                                                                                SHA1:E3992D665077177BAD5A4771F1BAF52C2AD1829C
                                                                                                                                                                                                                                                SHA-256:6F4754CE29DFA4F0E7957923249151CE8277395D1AF9F102D61B185F85899E4E
                                                                                                                                                                                                                                                SHA-512:FEBDB0BD6D0FD4C592DB781836F93F0C579399D324112F8829B769303CC6EEA487AAB14EBD60ED1B4F3B3DABF501601C9F65656327FF54853BF2CD9EC6A2F00F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\eo.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1285
                                                                                                                                                                                                                                                Entropy (8bit):4.3537859241297845
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83dRb4vyomrIsmZ55vrAO0LH+50ydAcveva:43PT5rWvrAR60yW6oa
                                                                                                                                                                                                                                                MD5:D87605E6282713EED41D56D53B7A04FD
                                                                                                                                                                                                                                                SHA1:41AAD4BD3B72CCBB6A762FEED3C24931642DD867
                                                                                                                                                                                                                                                SHA-256:98D52CAB5CA65789D1DC37949B65BAF0272AB87BCCBB4D4982C3AF380D5406AB
                                                                                                                                                                                                                                                SHA-512:4A4F51B2FD0248B52530B5D9FE6BFCFE455147CBE2C1F073804A53666945405F89CBBAD219FFF6904C1F92885F7C53B9D9A969732D662CEA8EC1717B3303B294
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \.. "di"\.. "lu"\.. "ma"\.. "me"\.. "\u0135a"\.. "ve"\.. "sa"].. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \.. "diman\u0109o"\.. "lundo"\.. "mardo"\.. "merkredo"\.. "\u0135a\u016ddo"\.. "vendredo"\.. "sabato"].. ::msgcat::mcset eo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "a\u016dg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset eo MONTHS_FULL [list \.. "januaro"\.. "februaro"\.. "marto"\.. "aprilo"\.. "majo"\.. "junio"\.. "julio"\.. "a\u016dgusto"\.. "septembro"\.. "oktobro"\.. "novembro"\.. "decembro"\.. ""].. ::m

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1232
                                                                                                                                                                                                                                                Entropy (8bit):4.2910064237800025
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83hEVIhlp4herIsYoorrClH+Fo9ARhprBvtFvr6:43OVY7+ercrmsYsr1thr6
                                                                                                                                                                                                                                                MD5:91DE6EE8E1A251EF73CC74BFB0216CAC
                                                                                                                                                                                                                                                SHA1:1FB01E3CF2CAFA95CC451BC34AB89DC542BBD7DD
                                                                                                                                                                                                                                                SHA-256:E9A6FE8CCE7C808487DA505176984D02F7D644425934CEDB10B521FE1E796202
                                                                                                                                                                                                                                                SHA-512:46CFD80E68461F165EE6A93AB6B433E4D4DA6A9A76CB7F3EF5766AC67567A7AFFB7B4E950A5AFA7C69C91F72AC82D2A448D32E39BBFC0BF26D2257460471EEC1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mi\u00e9"\.. "jue"\.. "vie"\.. "s\u00e1b"].. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \.. "domingo"\.. "lunes"\.. "martes"\.. "mi\u00e9rcoles"\.. "jueves"\.. "viernes"\.. "s\u00e1bado"].. ::msgcat::mcset es MONTHS_ABBREV [list \.. "ene"\.. "feb"\.. "mar"\.. "abr"\.. "may"\.. "jun"\.. "jul"\.. "ago"\.. "sep"\.. "oct"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset es MONTHS_FULL [list \.. "enero"\.. "febrero"\.. "marzo"\.. "abril"\.. "mayo"\.. "junio"\.. "julio"\.. "agosto"\.. "septiembre"\.. "octubre"\.. "noviembre"\.. "diciembre"\.. ""].. ::msgc

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_ar.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):248
                                                                                                                                                                                                                                                Entropy (8bit):4.878377455979812
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo8GzvFjot/W3v1o8T+3v9ysvn:4EnLB3833GzdV3vLK3vnn
                                                                                                                                                                                                                                                MD5:313966A7E4F50BB77996FDE45E342CA9
                                                                                                                                                                                                                                                SHA1:021DF7211DAE9A635D52F7005672C157DBBAE182
                                                                                                                                                                                                                                                SHA-256:B97DCEA4FEC3E14632B1511D8C4F9E5A157D97B4EBBC7C6EE100C3558CB2947F
                                                                                                                                                                                                                                                SHA-512:79DCC76263310523BAF1100C70918FCE6BECB47BE360E4A26F11C61F27E14FC28B588A9253AA0C1F08F45AE8A03312A30FBDCF4FDFFDC5BF9D086C4B539DE022
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_bo.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.924579610789789
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoYePWWjoU3v6ry/5oY7+3vPUe6HyFvn:4EnLB383nedh3v6ry/nS3vs3SVn
                                                                                                                                                                                                                                                MD5:EF58B1097A3C6F2133BD7AA8CCC1AD1B
                                                                                                                                                                                                                                                SHA1:BD479E4635F3CD70A6A90E07B7E92757BC9E2687
                                                                                                                                                                                                                                                SHA-256:B47F55539DB6F64304DEA080D6F9A39165F1B9D4704DCBA4C182DBD3AA31A11B
                                                                                                                                                                                                                                                SHA-512:F9EB1489E5002200D255A45DC57132DEFD2A2C6DE5BC049D0D9720575E4FDD1B6A212D9E15974C6A2E0D0886069EA0DD967AD7C20845EC38EB74CBED0C3E5BE1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_cl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.9352990174129925
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xodvPWWjok3v6ry/5odo+3vPUe6HyFvn:4EnLB383OdV3v6ry/i3vs3SVn
                                                                                                                                                                                                                                                MD5:42BCE0EE3A3F9E9782E5DE72C989903A
                                                                                                                                                                                                                                                SHA1:0960646417A61E8C31D408AE00B36A1284D0300E
                                                                                                                                                                                                                                                SHA-256:9D1A2A6EBA673C6F6D964DBCDDF228CB64978F282E70E494B60D74E16A1DB9CB
                                                                                                                                                                                                                                                SHA-512:C53DDCC17F261CFFAA2205879A131CFD23A7BCF4D3787090A0EA8D18530C4805903ED6CF31B53A34C70510A314EBBB68676E9F128289B42C5EFBC701405D5645
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_co.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.908553844782894
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo4FjbmvFjo4F+3v6ry/5o4++3vjb0f6HyFvn:4EnLB3831mdD+3v6ry/P3vbSVn
                                                                                                                                                                                                                                                MD5:6A8F31AE734DCEE4845454408CDB3BC5
                                                                                                                                                                                                                                                SHA1:A3B9A0124D3CFA9E0E5957612897B23193AD5D59
                                                                                                                                                                                                                                                SHA-256:5FAC53ACFB305C055AFD0BA824742A78CB506046B26DAC21C73F0BB60C2B889A
                                                                                                                                                                                                                                                SHA-512:188A65CFE2FBD04D83F363AEA166F224137C8A7009A9EBEB24B2A9AC89D9484D3A7109A4CE08F5C0A28911D81571230CC37554F4F19956AE163F9304911EE53C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_cr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.919346233482604
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo76GzvFjoTW3v6ry/5o76T+3v9f6HyFvn:4EnLB383K6Gzdj3v6ry/K6K3vMSVn
                                                                                                                                                                                                                                                MD5:2EDDA3F61BA4D049E6C871D88322CF72
                                                                                                                                                                                                                                                SHA1:40AFB64AF810596FCBDBD742ACAFE25CE56F3949
                                                                                                                                                                                                                                                SHA-256:A33DC22330D087B8567670B4915C334FF1741EE03F05D616CC801ECFDA1D9E64
                                                                                                                                                                                                                                                SHA-512:B6A6059B44F064C5CB59A3DAFAA7BE9064EE3E38F5FA6391017D931EF3A2B471DC4D556B7BEC6852FD1F6260EF17F476754D6BEA89E035748E9304977513CFB5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_do.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.913083040975068
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xomerQZ2jou3v6ry/5om7+3vrQZg6HyFvn:4EnLB383sk4/3v6ry/s3vkrSVn
                                                                                                                                                                                                                                                MD5:76CFD4F568EA799F9A4082865633FF97
                                                                                                                                                                                                                                                SHA1:B09846BBF7A78243A5075F2DC9241791DCBA434B
                                                                                                                                                                                                                                                SHA-256:8DC2F857E91912ED46A94EB6B37DD6170EA7BCDDCD41CB85C0926A74EE12FCC1
                                                                                                                                                                                                                                                SHA-512:58B20A8A5D1F8C19AC36E61965106266B7E6F7E95DDD6AD9C4BB9FD7FFC561CB0E2103639D901A6A78CE2DD154CBF7F3AE0F71B4DC1CCB11DC6BB40D9C6E2157
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_ec.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.915857529388286
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xozgzvFjoro+3v6ry/5oz9+3v9f6HyFvn:4EnLB383OgzdkF3v6ry/OI3vMSVn
                                                                                                                                                                                                                                                MD5:94B713B1560FE7711EA746F1CEBD37CD
                                                                                                                                                                                                                                                SHA1:E7047E8F04D731D38FA328FBC0E1856C4A8BB23D
                                                                                                                                                                                                                                                SHA-256:52AB5A6C9DD4F130A75C049B3AF8F54B84071FC190374BCCF5FA0E1F3B91EB21
                                                                                                                                                                                                                                                SHA-512:EE807D4D74A609F642CC3C6FC3D736708F67A6931DEB95288AB5822DA256BE4C908A346036195CF4266408458906D28BB5C715EEAFCACFC4FE45D4E6D8E435FE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_gt.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.9102355704853435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xohvjbmvFjoI3v6ry/5oho+3vjb0f6HyFvn:4EnLB383KmdJ3v6ry/W3vbSVn
                                                                                                                                                                                                                                                MD5:761D0A468DF2EE75BC2CAB09D5FF38CD
                                                                                                                                                                                                                                                SHA1:D627BE45FE71CCB3CA53153393C075FF5136C2F3
                                                                                                                                                                                                                                                SHA-256:19B4D3025156C060A16328370A3FDB9F141298DECFC8F97BE606F6438FECE2EE
                                                                                                                                                                                                                                                SHA-512:6CF7C9004A8A3B70495862B7D21921B1A6263C2153FEBC5C4997366498ABBFE70263B436C2B4998550780A4C3A58DCF0AAE7420FF9D414323D731FA44BD83104
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_hn.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.947925914291734
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoIvriSFjoP3v6ry/5oIo+3vrig6HyFvn:4EnLB383V+2m3v6ry/v3v+lSVn
                                                                                                                                                                                                                                                MD5:33CEE7F947A484B076F5FA7871A30FEB
                                                                                                                                                                                                                                                SHA1:F77F8D1F42008770A6FF1F5097C863ECF482BEBE
                                                                                                                                                                                                                                                SHA-256:07873D4D59BB41000706A844859C73D26B1FF794058AA83CFFCA804981A24038
                                                                                                                                                                                                                                                SHA-512:EBF6873F9CB554489EFCD352943100C00171E49D27153769D1C4DB25E2D1F44F2D34869B596C267C9BB59ED0444468D9982137CFB1C6035FB15A855BB867133B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_mx.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.9102355704853435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoPjbmvFjoH+3v6ry/5oI+3vjb0f6HyFvn:4EnLB383UmdD3v6ry/k3vbSVn
                                                                                                                                                                                                                                                MD5:678D7A6DC32355246BF3AC485A24AF4D
                                                                                                                                                                                                                                                SHA1:B6C273D3BE5FB9F5A221B0333870CCE41CEDFDE4
                                                                                                                                                                                                                                                SHA-256:A0F57137D2C0ABDC933E03CFB188F5632176C195CEADB9DC80D469C8DC6CEDC6
                                                                                                                                                                                                                                                SHA-512:571404CCB0591C681C975E3F7A6C6972FAF2362F1D48BFC95E69A9EAE2DB3F40BF4B666C41950C4924E3FD820C61ED91204F92283B8554F1BD35B64D53BD4125
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_ni.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.918215906418583
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoe/GriSFjo3W3v6ry/5oe/T+3vrig6HyFvn:4EnLB383Re+2eW3v6ry/RS3v+lSVn
                                                                                                                                                                                                                                                MD5:471C41907CE5DB1F30C647A789870F78
                                                                                                                                                                                                                                                SHA1:C575A639609620AF7C56430991D0E4C2B50BDEC5
                                                                                                                                                                                                                                                SHA-256:6250663DA1378E54BEDCEF206583D212BC0D61D04D070495238D33715BB20CAE
                                                                                                                                                                                                                                                SHA-512:CAE32DF8F583542CAFE3292501725D85B697A5C1F9A0A7993490E8A69B6CE5CE3DE3AA2733B14D989A8D13B5E31B437DB42E9AB9D1851FE72313592C752B5061
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_pa.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.906719336603863
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoX5rQZ2joHE3v6ry/5oXa+3vrQZg6HyFvn:4EnLB383ak4F3v6ry/G3vkrSVn
                                                                                                                                                                                                                                                MD5:571F6716293442672521F70854A5AD05
                                                                                                                                                                                                                                                SHA1:525EBDEA6F85FC769B6C0C0B179BD98381647123
                                                                                                                                                                                                                                                SHA-256:EBB661C1C09E7D4F6FBCC4B2DAD0F41442B1FFDD27F003ABDC0375DD316E57D7
                                                                                                                                                                                                                                                SHA-512:C6176EE48515BDFC09B8347DAC5FD2C0165AA765916457DC7B057E526785AC912481CB72F118D2943372213B23CE3C39739263C2B3DA4DBFEB24C522ACC0439D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_pe.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.90959433688075
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoIgzvFjoQ9X3v6ry/5oI9+3v9f6HyFvn:4EnLB383+zdB3v6ry/y3vMSVn
                                                                                                                                                                                                                                                MD5:5A5997D834DDD3E2E8FF8C6956AD54AC
                                                                                                                                                                                                                                                SHA1:AB4110E37B3665D738A8F2B3E64CBA9E99127301
                                                                                                                                                                                                                                                SHA-256:90C130B66958CF63CB3DDD2C633E58444357DBAB44C56831DD794CBD2EB1AED0
                                                                                                                                                                                                                                                SHA-512:1FEB8E77EA7B886E4A06279AC8A4B6200DBB86DCD28989651B92A0C9147A7BCFBB871DF8F904A1CF8F869BFFBD21325505AC44A4DBEBE1EFC87D43174597F1F3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_pr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.905689521403511
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo06GriSFjoeW3v6ry/5o06T+3vrig6HyFvn:4EnLB383gG+263v6ry/gK3v+lSVn
                                                                                                                                                                                                                                                MD5:CE811BB8D12C7E6D53338759CCFB0A22
                                                                                                                                                                                                                                                SHA1:0AED290AA479DE6887CCB58D3F0A0F379EF8D558
                                                                                                                                                                                                                                                SHA-256:F790E8E48DC079DCD7DEB58170561006A31294F7E4ACBF9CF2ABFA3DB9E3FA9E
                                                                                                                                                                                                                                                SHA-512:0C73654CC3D33F76D9BF545BD6C5E42CBDD10B6D9750BFD6536806010F3B6A3C3647FB9D5E7E75A39823FDB857E13D07B7F987809C94B9F980E6D3A6D3108E85
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_py.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.917539255090736
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo/5zvFjovE3v6ry/5o/a+3v9f6HyFvn:4EnLB383Czdt3v6ry/+3vMSVn
                                                                                                                                                                                                                                                MD5:9CD6FAC4121E3D287C87157142E32845
                                                                                                                                                                                                                                                SHA1:3081FE2197017EC8E052756A407880C1C4ED026A
                                                                                                                                                                                                                                                SHA-256:70263F7EB22822DFEE8849B7AC4418ED9331275A71E77236B59226396505CDFF
                                                                                                                                                                                                                                                SHA-512:25DC054085C4078734988EEDD87E31ABE93DA8B43512E924DE4BCDE9F8EC670436B72FAD1855484F9AC71DD0BEDD9ED30304D02219C4FFC4B0516D8889BDF9F9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_sv.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.929035824905457
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xofriSFjo3+3v6ry/5oY+3vrig6HyFvn:4EnLB383Y+22+3v6ry/Q3v+lSVn
                                                                                                                                                                                                                                                MD5:AF300EA6E733DC6820768EA16194B472
                                                                                                                                                                                                                                                SHA1:7766A6EB3D07BCC759CF6718EF3D6EC3FCE13565
                                                                                                                                                                                                                                                SHA-256:26A38B3745C95673D21BABB987F1D41EE08DDA945C670F5432BA0CE6F893C0E9
                                                                                                                                                                                                                                                SHA-512:C38D67C912584BE539D71881C6517AC186CBB336A160602DA716CE2708B2D38CE8FA7DD23EDB98890ABB7119B924B6C7816C18EC18F20C49D6284DF2386E32EE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_uy.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.923802447598272
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xooygzvFjooq9X3v6ry/5ooy9+3v9f6HyFvn:4EnLB3835rzdbsX3v6ry/5J3vMSVn
                                                                                                                                                                                                                                                MD5:2DC550FEC3F477B1159B824479BCE707
                                                                                                                                                                                                                                                SHA1:4D0B20CF3E50B64D74655A405A7750E0B0BB4375
                                                                                                                                                                                                                                                SHA-256:1291B58810739EA0651493DD7887F5EE3E14BDB806E06DD4BB8AE2520C742EDA
                                                                                                                                                                                                                                                SHA-512:B12B927ACA6274904928A6A6CAEC8339A794C74A1F1804FF93AABC132AF9AD8AC5117F20067A60EFEBC9887150D7ACA5BE9643FF61509666011FD203211C25B9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\es_ve.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.928484426267027
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoXrzvFjoXK3v6ry/5oXs+3v9f6HyFvn:4EnLB3838zdv3v6ry/c3vMSVn
                                                                                                                                                                                                                                                MD5:184D6C4B9F0AA874DEB959F63F7CC01B
                                                                                                                                                                                                                                                SHA1:5FB370B498289590C977F6B489FF646F0FB27425
                                                                                                                                                                                                                                                SHA-256:91191517403C712299919F9C797F952502E33CB6961D1DBEE3A7C9E8D2B170B9
                                                                                                                                                                                                                                                SHA-512:881CCAB0950AE993744ECCA141120C005F53D684167A3E5CBDDF950D110D630FB2B4F6AE6E3D0E06D5110AE25EA00A4F4DAFB03AD3B227DC8C63464D434431DA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\et.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1258
                                                                                                                                                                                                                                                Entropy (8bit):4.391217201307309
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83P1Y2+1YoQVTsC/m48qpRTVTR7I/68qqq4Z0yoN7emG5wsvtqmsv5t:43P1p+1jQ9sq8y9v8Yko7emG5wKtqmKX
                                                                                                                                                                                                                                                MD5:C8C5EF2FA6DD8DBD5BBD2699BE1A0BF6
                                                                                                                                                                                                                                                SHA1:F5E26B40786B8987C98F9CBDEF5522043574A9ED
                                                                                                                                                                                                                                                SHA-256:4BEE224C21B0483CFF39BE145C671AA20CB7872C8727FD918C0E8ECA2BBEB172
                                                                                                                                                                                                                                                SHA-512:757FA85C137A11C1A3F4A8392C7A4E4030A67D0E593FA25A98BEC07DB295399AB2C0D9EBE61E07420B14387A29C060DC3AF812A1E7B85110DBB13C3C3DCB3600
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \.. "P"\.. "E"\.. "T"\.. "K"\.. "N"\.. "R"\.. "L"].. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \.. "p\u00fchap\u00e4ev"\.. "esmasp\u00e4ev"\.. "teisip\u00e4ev"\.. "kolmap\u00e4ev"\.. "neljap\u00e4ev"\.. "reede"\.. "laup\u00e4ev"].. ::msgcat::mcset et MONTHS_ABBREV [list \.. "Jaan"\.. "Veebr"\.. "M\u00e4rts"\.. "Apr"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "Aug"\.. "Sept"\.. "Okt"\.. "Nov"\.. "Dets"\.. ""].. ::msgcat::mcset et MONTHS_FULL [list \.. "Jaanuar"\.. "Veebruar"\.. "M\u00e4rts"\.. "Aprill"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "August"\.. "September"\.. "Oktoober"\.. "November"\.. "De

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\eu.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1032
                                                                                                                                                                                                                                                Entropy (8bit):4.002617252503668
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83DEXk8TT7vXk8TTMtzCIsOo/ssP6tvf1I49sHT:434bTbbTc+RjKi4mz
                                                                                                                                                                                                                                                MD5:ED9805AF5BFB54EB28C6CB3975F86F5B
                                                                                                                                                                                                                                                SHA1:2BD91BD850028712F35A2DDB2555036FBF6E8114
                                                                                                                                                                                                                                                SHA-256:6889B57D29B670C6CFB7B5A3F2F1749D12C802E8E9629014D06CE23C034C7EF1
                                                                                                                                                                                                                                                SHA-512:16F31DE5D2B0D3ED2D975C7891C73C48F073CDAC28F17572FC9424C2D384DDFE9E5E235F17C788F42840CB2D819D2D9499B909AB80FEF1B09F2AE1627CF1DADC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu MONTHS_ABBREV [list \.. "urt"\.. "ots"\.. "mar"\.. "api"\.. "mai"\.. "eka"\.. "uzt"\.. "abu"\.. "ira"\.. "urr"\.. "aza"\.. "abe"\.. ""].. ::msgcat::mcset eu MONTHS_FULL [list \.. "urtarrila"\.. "otsaila"\.. "martxoa"\.. "apirila"\.. "maiatza"\.. "ekaina"\.. "uztaila"\.. "abuztua"\.. "iraila"\.. "urria"\.. "azaroa"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\eu_es.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):294
                                                                                                                                                                                                                                                Entropy (8bit):4.915392589807169
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoszFnJF+l6VvBoszw3vLjoszw3v6mjosz++3v/RHvn:4EnLB383FL+l6VQ3vO3v6G3vZPn
                                                                                                                                                                                                                                                MD5:4C91AA000D4316585893025CBB96E910
                                                                                                                                                                                                                                                SHA1:3D4E73839A1A8CB9DEC1E59D9D2813257D9480F0
                                                                                                                                                                                                                                                SHA-256:D45CC432E5743E6CEC34E9A1E0F91A9D5C315CDA409E0826B51AD9D908479EB6
                                                                                                                                                                                                                                                SHA-512:0731F2EEB22ADC7EF8AF215B9EB4C5A66B33BC90E4F80CF7AA482AD002CB30543547230124A0507EC79EDDD6903A042EDA5D7C8AFD77F7FC994EFC6853FABB05
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da".. ::msgcat::mcset eu_ES TIME_FORMAT "%T".. ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T".. ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fa.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1711
                                                                                                                                                                                                                                                Entropy (8bit):4.21837106187395
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83CnMqnbxbGwgjSyiY/Xw2mS1yM/8ye48YyfNqTb2gyj/8yHkQp:43Yzyhgvs9yi4P
                                                                                                                                                                                                                                                MD5:7AB25F4E7E457469DC61A33176B3AA72
                                                                                                                                                                                                                                                SHA1:EEA98283D250A99E33DD4D5D9B1B76A029716CE6
                                                                                                                                                                                                                                                SHA-256:86898728B275288693B200568DC927C3FF5B9050690876C4441A8339DAE06386
                                                                                                                                                                                                                                                SHA-512:7524437F91E91751BEB7A378D7674C49E5D84B716FE962F4C23580C46A671F3F33638FCD37A8F90C86E24DA8F54448E06AC9C3AEFFB5613E94A04E512C1AD68D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0648\u062a

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fa_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2009
                                                                                                                                                                                                                                                Entropy (8bit):4.491667766230948
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83KnMqnbxbGUgjDiY/Xw2mS1yM/8ye48tfNqTb2gyj/8yHkQLoRv9v/vNv0P:43wihgvsai4Rmv53JU
                                                                                                                                                                                                                                                MD5:C59EE7CA80AD9F612A21C8B6674A820E
                                                                                                                                                                                                                                                SHA1:AEFD631EFC1892063244FA622DE1A091C461E370
                                                                                                                                                                                                                                                SHA-256:6B56545C1AE1DE53BC2389BB7AE59F115BADE24F907E384E079491DC77D6541D
                                                                                                                                                                                                                                                SHA-512:42F52091480599D317FB80DF8E52A6C6F88614C6172BF4033974DD136FB30E6F47D38982C8A7BC14CF3165C3EBAE3680F94DF3A0ED079AB68165286251CD0BD7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fa_ir.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):426
                                                                                                                                                                                                                                                Entropy (8bit):5.12739029869254
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:4EnLB383D2WGz7A/3vy3v6TANCmK3vz7AAbn:4aR83DoPivkvFk5vPN
                                                                                                                                                                                                                                                MD5:9778A7C3ABD37ECBEC0BB9715E52FAF8
                                                                                                                                                                                                                                                SHA1:D8063CA7779674EB1D9FE3E4B4774DB20B93038B
                                                                                                                                                                                                                                                SHA-256:3D9779C27E8960143D00961F6E82124120FD47B7F3CB82DB3DF21CDD9090C707
                                                                                                                                                                                                                                                SHA-512:B90B4A96CE5E8B9BF512B98C406603C60EA00F6740D04CD1FC30810C7155A37851AE5E28716F959137806F1A9E3152D2A0D79B8EA7E681A0737A28593657DE66
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d".. ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631".. ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y".. ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H".. ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P".. ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fi.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1195
                                                                                                                                                                                                                                                Entropy (8bit):4.32217771842326
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83KTvIhmuw4tW/UWJTttWKeqA+3ewvtyv3e6:43YvIwuw4t05ttnlzt0p
                                                                                                                                                                                                                                                MD5:CC06F0ABD8F985654DAD8256598EBCB7
                                                                                                                                                                                                                                                SHA1:71C880F9F395ACD32AF7F538033211F392F83645
                                                                                                                                                                                                                                                SHA-256:9929A6B7139BD7E0F29487F7888A83E4C4F5E9CE0352738CFCA94EE2DDF3BD6B
                                                                                                                                                                                                                                                SHA-512:E1292665270B6FBF7738CC3864B55194E7B827C6AD9492FB2E54DC1B626159B243052CE502335B9D92E2B8F58A4DD1FA0E628CB6A9D1D3A652FE2B93A3FB711A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "ma"\.. "ti"\.. "ke"\.. "to"\.. "pe"\.. "la"].. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \.. "sunnuntai"\.. "maanantai"\.. "tiistai"\.. "keskiviikko"\.. "torstai"\.. "perjantai"\.. "lauantai"].. ::msgcat::mcset fi MONTHS_ABBREV [list \.. "tammi"\.. "helmi"\.. "maalis"\.. "huhti"\.. "touko"\.. "kes\u00e4"\.. "hein\u00e4"\.. "elo"\.. "syys"\.. "loka"\.. "marras"\.. "joulu"\.. ""].. ::msgcat::mcset fi MONTHS_FULL [list \.. "tammikuu"\.. "helmikuu"\.. "maaliskuu"\.. "huhtikuu"\.. "toukokuu"\.. "kes\u00e4kuu"\.. "hein\u00e4kuu"\.. "elokuu"\.. "syyskuu"\.. "lokakuu"\.. "marraskuu"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fo.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1033
                                                                                                                                                                                                                                                Entropy (8bit):4.15884265510429
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR834YPxTSBFSa+E6rIsmYmyAxyIQbXHU92W1T:43a6rIyAE0B
                                                                                                                                                                                                                                                MD5:5D224E66FD9521CA4327D4F164CD6585
                                                                                                                                                                                                                                                SHA1:FC8F4C1D9A69931679028DE02155D96A18F6542E
                                                                                                                                                                                                                                                SHA-256:2EC9B03469FA38B260915C93318F446EA5E12B9090BD441936B57552EBA1E3C9
                                                                                                                                                                                                                                                SHA-512:0E0F97D99F0274A8A92AA7DC992B252A0BB696D69A8835602D8F4C03A6A15780F45971F00863436949CD81AD7DF6EE6BC463CE5B9FECF5E39508BA4D4E83C693
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \.. "sun"\.. "m\u00e1n"\.. "t\u00fds"\.. "mik"\.. "h\u00f3s"\.. "fr\u00ed"\.. "ley"].. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nadagur"\.. "t\u00fdsdagur"\.. "mikudagur"\.. "h\u00f3sdagur"\.. "fr\u00edggjadagur"\.. "leygardagur"].. ::msgcat::mcset fo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset fo MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "apr\u00edl"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fo_fo.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.864028070948858
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoZA4WjoZd3vLjoZd3v6mjoZd+3vnFDoAkvn:4EnLB3831P23vS3v6u3v9dmn
                                                                                                                                                                                                                                                MD5:92E2B6483B2374817548F4EAA1731820
                                                                                                                                                                                                                                                SHA1:071E1E9368CCB4EC864E78622B2113F460920203
                                                                                                                                                                                                                                                SHA-256:C3DCCF5E5904C24D4AD9AAA36160A78F5397A7452510C0C0E61DE4DE863305CB
                                                                                                                                                                                                                                                SHA-512:E79D4D38A22298252FA46D15C383CFB2A1E49E8196C265A58F9BA4982DFD9CE29E87C0B85BE3F39617359451831B792FCD3092A52EDF8FFD999AFE5CFE1D170D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y".. ::msgcat::mcset fo_FO TIME_FORMAT "%T".. ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T".. ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1257
                                                                                                                                                                                                                                                Entropy (8bit):4.383721663740675
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR835LzAX2t6KOkPwzZIGzRmzQf1waGqHvivh:43mlwIFZtA/qPkh
                                                                                                                                                                                                                                                MD5:4D63B4A7CF13A28A6F6784B5597EEF43
                                                                                                                                                                                                                                                SHA1:FE1B35A93CB72666D7D6BC37D9BE081B05A00CD9
                                                                                                                                                                                                                                                SHA-256:96B1E1E12CD13A56722EBF27D362C70B467342FA1282A40B89FB16B5105A0480
                                                                                                                                                                                                                                                SHA-512:5647CAE859B62C7CE1CEE6426A076361D2A29EFE6B6F311DDC0E7D006194BA68D575852FEC5FDE2AB43DF8AE440C57013D32A3951095CB856327070FD9BD1C76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \.. "dim."\.. "lun."\.. "mar."\.. "mer."\.. "jeu."\.. "ven."\.. "sam."].. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \.. "dimanche"\.. "lundi"\.. "mardi"\.. "mercredi"\.. "jeudi"\.. "vendredi"\.. "samedi"].. ::msgcat::mcset fr MONTHS_ABBREV [list \.. "janv."\.. "f\u00e9vr."\.. "mars"\.. "avr."\.. "mai"\.. "juin"\.. "juil."\.. "ao\u00fbt"\.. "sept."\.. "oct."\.. "nov."\.. "d\u00e9c."\.. ""].. ::msgcat::mcset fr MONTHS_FULL [list \.. "janvier"\.. "f\u00e9vrier"\.. "mars"\.. "avril"\.. "mai"\.. "juin"\.. "juillet"\.. "ao\u00fbt"\.. "septembre"\.. "octobre"\.. "novembre"\.. "d\u00e9cembre

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fr_be.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.910112619660625
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoXqyFjoIX3vLjoIX3v6mjog+3vnFDoAkvn:4EnLB383AqWv3vL3v6d3v9dmn
                                                                                                                                                                                                                                                MD5:07EEADB8C2F2425FF9A27E46A81827A2
                                                                                                                                                                                                                                                SHA1:AA18A651C64098C7885F1F869B9F221453F42987
                                                                                                                                                                                                                                                SHA-256:AAD828BCBB512FBD9902DCDD3812247A74913CC574DEB07DA95A7BBE74B1FE48
                                                                                                                                                                                                                                                SHA-512:1FA60B1A69B2F5FD2C009EC18695A937C4484D7C418F7E8398D95723B857698143E0584A546F9032B75894730CBBEF78453061AC13D90199FF702E148D983C28
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset fr_BE TIME_FORMAT "%T".. ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fr_ca.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.890376345610709
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xooIso13vLjo13v6mjo1+3vnFDoAkvn:4EnLB383vIF3vU3v6A3v9dmn
                                                                                                                                                                                                                                                MD5:2F70BDDE7685E2892C5F79C632FC2F0F
                                                                                                                                                                                                                                                SHA1:FD1A6F6042E59D1563ABB5858C348C1D785C435E
                                                                                                                                                                                                                                                SHA-256:0624DF9A56723DDB89E59736C20A5837DEA2206A789EBE7EEF19AD287590CA45
                                                                                                                                                                                                                                                SHA-512:50FC0C91AB2C75FFC4F100C0D42DFC4B2101DB9713FD77E6FF5BF3F25A0AF4A535A4709CF4586809CEEE76C25B66ABC0DD4FD61524510C57AA0E63EA8F46E8D5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset fr_CA TIME_FORMAT "%T".. ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\fr_ch.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):288
                                                                                                                                                                                                                                                Entropy (8bit):4.913241133684606
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoFt28oF+3vLjoF+3v6mjo++3vnFDoAkvn:4EnLB383yte+3vs+3v6/3v9dmn
                                                                                                                                                                                                                                                MD5:83FC7EBA68C3727F7C13C8EEAF79823F
                                                                                                                                                                                                                                                SHA1:81C27F9B97F5F5190F7189230535EC09CD228158
                                                                                                                                                                                                                                                SHA-256:290CA6EB74BAEAC4E2420D0755D148849F89EE87E37860F25CBB7B8AFA3EDCBC
                                                                                                                                                                                                                                                SHA-512:35DA46558A246D7B3FAB02208001CE986E2E6DD88D6318AF743F4E81CA6920471D1425BB009A7476A79E7F61E1353C027B765331CD8EFA07A9E884DCB73F2195
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y".. ::msgcat::mcset fr_CH TIME_FORMAT "%T".. ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ga.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1188
                                                                                                                                                                                                                                                Entropy (8bit):4.314271783103334
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR835k0CM/hlrXa754pD73/tKSx54pbIK5f2CA:43W05rXUa173/VadDA
                                                                                                                                                                                                                                                MD5:67D137E5D853DB61A4B4264871E793F7
                                                                                                                                                                                                                                                SHA1:4280E7F662DE792175AF8B4C93874F035F716F0F
                                                                                                                                                                                                                                                SHA-256:880806867ACABD9B39E3029A5ADD26B690CC5709082D43B0959EBA725EA07AB5
                                                                                                                                                                                                                                                SHA-512:C27B745143539D3E6D94BB754DCA35065CDE9B1AA6EE038D47F658175CFACC20236124D38BE5BBB03CAF8F613BD748C43CB8DFCC9234E915D18B5A477BAEF94E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \.. "Domh"\.. "Luan"\.. "M\u00e1irt"\.. "C\u00e9ad"\.. "D\u00e9ar"\.. "Aoine"\.. "Sath"].. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \.. "D\u00e9 Domhnaigh"\.. "D\u00e9 Luain"\.. "D\u00e9 M\u00e1irt"\.. "D\u00e9 C\u00e9adaoin"\.. "D\u00e9ardaoin"\.. "D\u00e9 hAoine"\.. "D\u00e9 Sathairn"].. ::msgcat::mcset ga MONTHS_ABBREV [list \.. "Ean"\.. "Feabh"\.. "M\u00e1rta"\.. "Aib"\.. "Beal"\.. "Meith"\.. "I\u00fail"\.. "L\u00fan"\.. "MF\u00f3mh"\.. "DF\u00f3mh"\.. "Samh"\.. "Noll"\.. ""].. ::msgcat::mcset ga MONTHS_FULL [list \.. "Ean\u00e1ir"\.. "Feabhra"\.. "M\u00e1rta"\.. "Aibre\u00e1n"\.. "M\u00ed na Bealtaine"\.. "Meith"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ga_ie.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.824539027053997
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xobHAygDobHAqo+3vLjobHAqo+3v6mjobHAy9+3vnFDoAkv:4EnLB383p23vy3v6a3v9dmn
                                                                                                                                                                                                                                                MD5:C27BD7F317AAADB380F4C38AE0D2FDA6
                                                                                                                                                                                                                                                SHA1:79870A0E68AA0A9B301414EDC21889F83BB81E40
                                                                                                                                                                                                                                                SHA-256:3F9615C617D3CDBC1E127B3EFEE785B0CB5E92E17B7DABAC80DA2BEAF076362C
                                                                                                                                                                                                                                                SHA-512:3605B9A914284CF1D3CC90DF2F21A86C0472AEE59800942DC93D842C7AE164E1DA72813787F163DC80B72269D2C391953ABAD6A8B72CCF069BEE96D418A173E9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y".. ::msgcat::mcset ga_IE TIME_FORMAT "%T".. ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\gl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):997
                                                                                                                                                                                                                                                Entropy (8bit):4.120890519790248
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83okzalCcPdJ5rK8yzMY4JlV1ZDqqIkFo8w:43JkPj9K8y4HHZLIQtw
                                                                                                                                                                                                                                                MD5:A3D098C1A47E380F7C25233A52FBDE38
                                                                                                                                                                                                                                                SHA1:C97E4EAA9E7A7F99950F422B93C57134B532C639
                                                                                                                                                                                                                                                SHA-256:34D61B49DBF9584893051FFB458D6DE9E7E2E7774AC0011F70C4DD4184EBA81C
                                                                                                                                                                                                                                                SHA-512:4687AB3D2FAA65FED90678EBC08C074959E93A9FEFAF3D61EEE39DB08FD200CB57C0DDB4DDBF6451FE1EF5E07EA976EDEF830769FF403CE51734129CEF24DA9F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Lun"\.. "Mar"\.. "M\u00e9r"\.. "Xov"\.. "Ven"\.. "S\u00e1b"].. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Luns"\.. "Martes"\.. "M\u00e9rcores"\.. "Xoves"\.. "Venres"\.. "S\u00e1bado"].. ::msgcat::mcset gl MONTHS_ABBREV [list \.. "Xan"\.. "Feb"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Xu\u00f1"\.. "Xul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset gl MONTHS_FULL [list \.. "Xaneiro"\.. "Febreiro"\.. "Marzo"\.. "Abril"\.. "Maio"\.. "Xu\u00f1o"\.. "Xullo"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Decembro"\.. ""]..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\gl_es.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.886176304042503
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoPhkgMoPxsF3v6ay/5oPhk9+3vR6HyFvn:4EnLB383WrfK3v6ay/WJ3voSVn
                                                                                                                                                                                                                                                MD5:78B9163C5E8E5E7049CBF91D1A5889A4
                                                                                                                                                                                                                                                SHA1:F2F07AF3D79D61C8E0C73B13E2CA8266E10E396B
                                                                                                                                                                                                                                                SHA-256:B5688CA07D713227B713655877710258CD503617E8DF79293A971649E3134F05
                                                                                                                                                                                                                                                SHA-512:E86074B687670542CFA097C94D150292E1A73C9F231E92CD84386580A446569CC6F8F5817F46ED64A1D00F95D59F6F1F5D4B961DF3C8335938D83F3517794353
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\gv.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1084
                                                                                                                                                                                                                                                Entropy (8bit):4.213672208102291
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR832vTXAC2/fS5JfaCroeLaCAQbSm5qJe1:43QTXs32zrf
                                                                                                                                                                                                                                                MD5:518FC3964D50854081FB79189A42D3E7
                                                                                                                                                                                                                                                SHA1:59392F16CD56E3E6A685F78974D539FB3A972B98
                                                                                                                                                                                                                                                SHA-256:404795F2C88D0038F9ED0B5120A251D26EDF8B236E1B1698BC71ACD4DC75AC45
                                                                                                                                                                                                                                                SHA-512:E5C88CAB8741D631938CEC2E0959C0FE26685C395F5F9F4F1B5C9E146E84D23D897CD7A823AB46D4B62C590AE15EC76B87EB59308ACFB1BB6F61398890B43622
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \.. "Jed"\.. "Jel"\.. "Jem"\.. "Jerc"\.. "Jerd"\.. "Jeh"\.. "Jes"].. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \.. "Jedoonee"\.. "Jelhein"\.. "Jemayrt"\.. "Jercean"\.. "Jerdein"\.. "Jeheiney"\.. "Jesarn"].. ::msgcat::mcset gv MONTHS_ABBREV [list \.. "J-guer"\.. "T-arree"\.. "Mayrnt"\.. "Avrril"\.. "Boaldyn"\.. "M-souree"\.. "J-souree"\.. "Luanistyn"\.. "M-fouyir"\.. "J-fouyir"\.. "M.Houney"\.. "M.Nollick"\.. ""].. ::msgcat::mcset gv MONTHS_FULL [list \.. "Jerrey-geuree"\.. "Toshiaght-arree"\.. "Mayrnt"\.. "Averil"\.. "Boaldyn"\.. "Mean-souree"\.. "Jerrey-souree"\.. "Luanistyn"\.. "Mean-fouyir"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\gv_gb.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.936566750568767
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoQbtvMoQLE3v6ay/5oQbto+3vR6HyFvn:4EnLB383PbtvALE3v6ay/PbtF3voSVn
                                                                                                                                                                                                                                                MD5:0B6BE614EF5F5F25A30D2D33701A9F94
                                                                                                                                                                                                                                                SHA1:65800FBD73D9DAE550E04E1D818A6B9D1AEF86FE
                                                                                                                                                                                                                                                SHA-256:86CABF3B9360C0E686CC4CBEB843E971C28BC6D35210ED378B54EB58CC41F3D5
                                                                                                                                                                                                                                                SHA-512:376D21B38DA49A8F7C2983F2B808FD55AC9F6383BC66DF28DB99DBF61FDC9FFF8CD20F077EC3ED873EF47F0F613BDD9AD02DFFB1CB51F9A36715C7FC798C3B70
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\he.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1990
                                                                                                                                                                                                                                                Entropy (8bit):4.298934047406144
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83Y71LCLxL0eCLbCLKCLaCLXL7CLB0p1dLGCoCLU5LT5Gv5LJ9p5LnLEHLGCh:43sl7KqpU/nNbhbOezd2ICn
                                                                                                                                                                                                                                                MD5:A0E60036EB17208A449AAFC3AAAE622C
                                                                                                                                                                                                                                                SHA1:9D7479BA85FBB00A2DF2B61F4ED2CBEA8F1EC8C3
                                                                                                                                                                                                                                                SHA-256:787DA79AF58872BF45AB09E3B6A920A4496B5BD8A4F3C7F010CF013EC2E8EFE0
                                                                                                                                                                                                                                                SHA-512:46D12C14B5736E5EA97EB728BF58999E9D7C2CF910D8F5AFA3F5D3A86329ABF41A3E2BEBD81EE4EF64BEA0DC173B77A9FE12471C1BD9D768ED552A55B3B80213
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \.. "\u05d0"\.. "\u05d1"\.. "\u05d2"\.. "\u05d3"\.. "\u05d4"\.. "\u05d5"\.. "\u05e9"].. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \.. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\.. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\.. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\.. "\u05e9\u05d1\u05ea"].. ::msgcat::mcset he MONTHS_ABBREV [list \.. "\u05d9\u05e0\u05d5"\.. "\u05e4\u05d1\u05e8"\.. "\u05de\u05e8\u05e5"\.. "\u05d0\u05e4\u05e8"\.. "\u05de\u05d0\u05d9"\.. "\u05d9\u05d5\u05e0"\.. "\u05d9\u05d5\u05dc"\.. "\u05d0\u05d5\u05d2"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\hi.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1777
                                                                                                                                                                                                                                                Entropy (8bit):4.2117128941697715
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:438n4kALqrU1fbokQTbWqrU1fbokQTw38:28OD86D8gM
                                                                                                                                                                                                                                                MD5:4219A929E27308ADC04A9F368F063F38
                                                                                                                                                                                                                                                SHA1:FA728EEBA8751F4CE032ED32AECFDE124D1B68E2
                                                                                                                                                                                                                                                SHA-256:192F4A8E77E1627712F85533C9896EF6A040157C7BD56DF3A4A7FA56AD6746C2
                                                                                                                                                                                                                                                SHA-512:223B137AC1FC15908F5541067736EF3A29493549B963393EB78660036A82982E57CFC4AD09CBD33D32A5187FF9F4ACFB5F83A0C974702434B7FAD1B2539B7F76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset hi MONTHS_ABBREV [list \.. "\u091c\u0928\u0935\u0930\u0940"\.. "\u092b\u093c\u0930\u0935\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u0905\u092a\u094d\u0930\u0947\u0932"\.. "\u092e\u0908"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u093e\u0908"\.. "\u0905\u0917\u0938\u094d\u0924"\.. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\.. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\.. "\u0928\u0935\u

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\hi_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.9286948144352865
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xocv+IZoz3v6ry/5oco+3v+6f6HyFvn:4EnLB383Jvlg3v6ry/JF3vmSVn
                                                                                                                                                                                                                                                MD5:1C1E1484EA0286175FADCB90937C9F34
                                                                                                                                                                                                                                                SHA1:5CA1BF19021D529CB3B3A308EFFFCA7E4D073640
                                                                                                                                                                                                                                                SHA-256:5A3BF0DD61BFB5A2BF75E96B11E0E3528FFAB720A0BF1923853606F8CAF0E76D
                                                                                                                                                                                                                                                SHA-512:F9A43E1E18ADB6DC6B18BEDC3303A99F514DF6CA54F12100989F734233012D7D60216116915351CCACC12F6942795BF8F3BBD26B15A86E88101067D64BEE54F5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\hr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1171
                                                                                                                                                                                                                                                Entropy (8bit):4.36311224714184
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83dVX79VIE9bLTWnh7rT+5dPcdvgrNv5KvOA1:43kmrQ7n+odIrJ6OS
                                                                                                                                                                                                                                                MD5:906963A3AD09EAC781B35C190B77484E
                                                                                                                                                                                                                                                SHA1:E5AA49DA9C4987EAFA839115F84612426EB8615E
                                                                                                                                                                                                                                                SHA-256:105A9180BC5D23738183374FA0EA8DD80484BF3947E1432E515BDC2913C017D9
                                                                                                                                                                                                                                                SHA-512:557BD1C8306750D09215D9774069A52C7D60E03DE2DF39FF909A8F658AB0565739D127E24ACDC96F736C69A71BEFA30B8A30BB489C7B7FDEA85386C802166349
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \.. "ned"\.. "pon"\.. "uto"\.. "sri"\.. "\u010det"\.. "pet"\.. "sub"].. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \.. "nedjelja"\.. "ponedjeljak"\.. "utorak"\.. "srijeda"\.. "\u010detvrtak"\.. "petak"\.. "subota"].. ::msgcat::mcset hr MONTHS_ABBREV [list \.. "sij"\.. "vel"\.. "o\u017eu"\.. "tra"\.. "svi"\.. "lip"\.. "srp"\.. "kol"\.. "ruj"\.. "lis"\.. "stu"\.. "pro"\.. ""].. ::msgcat::mcset hr MONTHS_FULL [list \.. "sije\u010danj"\.. "velja\u010da"\.. "o\u017eujak"\.. "travanj"\.. "svibanj"\.. "lipanj"\.. "srpanj"\.. "kolovoz"\.. "rujan"\.. "listopad"\.. "studeni"\.. "prosinac"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\hu.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1381
                                                                                                                                                                                                                                                Entropy (8bit):4.511450677731002
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83IFb7ZTmKrkAYm2LZyyApLDV2uZi5WF+shHUTyvtsv+:43C3ZTmKQAyZyyAp0BotK+
                                                                                                                                                                                                                                                MD5:E398158EE1CD49CB5286D9642D4A61DD
                                                                                                                                                                                                                                                SHA1:A93A588B0ADD198C067C4BB070DC1E5170E6E208
                                                                                                                                                                                                                                                SHA-256:993475532F89E1EA7214ADB265294040862305612D680CFF01DD20615B731CCC
                                                                                                                                                                                                                                                SHA-512:9E5791FB97110FE5F7A1F49FF2ED8801A05E49D5B9AF579474C0081073D2B40ECFFE6E4EB5B61F12B1995FDCC0A557CB572E5E116F951FD286A6254253DAEC01
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \.. "V"\.. "H"\.. "K"\.. "Sze"\.. "Cs"\.. "P"\.. "Szo"].. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \.. "vas\u00e1rnap"\.. "h\u00e9tf\u0151"\.. "kedd"\.. "szerda"\.. "cs\u00fct\u00f6rt\u00f6k"\.. "p\u00e9ntek"\.. "szombat"].. ::msgcat::mcset hu MONTHS_ABBREV [list \.. "jan."\.. "febr."\.. "m\u00e1rc."\.. "\u00e1pr."\.. "m\u00e1j."\.. "j\u00fan."\.. "j\u00fal."\.. "aug."\.. "szept."\.. "okt."\.. "nov."\.. "dec."\.. ""].. ::msgcat::mcset hu MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "m\u00e1rcius"\.. "\u00e1prilis"\.. "m\u00e1jus"\.. "j\u00fanius"\.. "j\u00falius"\.. "augusztus"\.. "szeptembe

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\id.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):961
                                                                                                                                                                                                                                                Entropy (8bit):4.02166638427728
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83dcTcWKutdXaMmEfc2ftdT2dHblWZ0VT:43dQrKutdntdI8g
                                                                                                                                                                                                                                                MD5:191ACF2E8A8F10A1360B283D42886382
                                                                                                                                                                                                                                                SHA1:EE2C00D021381EA638B6CE3F395DEA5F8491ED9B
                                                                                                                                                                                                                                                SHA-256:41C0C3D3B4491E9B36E719466503EFCD325175CB7824C4A5055CB113D347BE0F
                                                                                                                                                                                                                                                SHA-512:29BC4F7D3FAE7DE392B175FEA76138FA823B7D9D0B051A19A73F7D36D51DE34E0D0C7C129867307ABF51FC92E70853C15BD96B8484AD21EAB0A8EB83B0411E03
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \.. "Min"\.. "Sen"\.. "Sel"\.. "Rab"\.. "Kam"\.. "Jum"\.. "Sab"].. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \.. "Minggu"\.. "Senin"\.. "Selasa"\.. "Rabu"\.. "Kamis"\.. "Jumat"\.. "Sabtu"].. ::msgcat::mcset id MONTHS_ABBREV [list \.. "Jan"\.. "Peb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Agu"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset id MONTHS_FULL [list \.. "Januari"\.. "Pebruari"\.. "Maret"\.. "April"\.. "Mei"\.. "Juni"\.. "Juli"\.. "Agustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""]..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\id_id.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.904408530699153
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo0kGMo0F/W3v6ay/5o0kT+3vR6HyFvn:4EnLB383wG33v6ay/wK3voSVn
                                                                                                                                                                                                                                                MD5:FEB4D50576BF3E11A0A40FD29ABE35A7
                                                                                                                                                                                                                                                SHA1:8CEAA187C8AA5EC101743060A877D039850964CA
                                                                                                                                                                                                                                                SHA-256:BA7FC0C0452D3E482DB6E19BDF512CACED639BA72B92ED8F66D80B52FEA11AC0
                                                                                                                                                                                                                                                SHA-512:8B5D18E3D6628F369FB387C8EF08CC80000E0CBE500972958F4AD75F1C2F0DD6058F9777BD7DD0D7C26E7ECAA65E5071E2BF51B560973E88637942116C7576FB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y".. ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\is.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1305
                                                                                                                                                                                                                                                Entropy (8bit):4.457417703528286
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83XVhVTeMVHGPbfXSmWzaZlfFxUQbW1U6ZY95n123etvmv3eTn:43Xz0b/uzaZtXUMw8n
                                                                                                                                                                                                                                                MD5:ACF0452D5BB6D36A40061D2B0AF4D7A6
                                                                                                                                                                                                                                                SHA1:9DF4D88F1962A672EFBDDE524550F7A5D02D446D
                                                                                                                                                                                                                                                SHA-256:778BE3D6BFE2DFFB64FF1AFB9EC8351A3343B314CF93A68E8F7FD1073EE122BB
                                                                                                                                                                                                                                                SHA-512:34CC02D7D28B5E161ED10250C214375561FD3D00979BFB8BCF3DB72A81BD9B7C225301528B400F7C54D8B6379F772EB6477D5D03F2CF7DC4DD19D22AEEC151B5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \.. "sun."\.. "m\u00e1n."\.. "\u00feri."\.. "mi\u00f0."\.. "fim."\.. "f\u00f6s."\.. "lau."].. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nudagur"\.. "\u00feri\u00f0judagur"\.. "mi\u00f0vikudagur"\.. "fimmtudagur"\.. "f\u00f6studagur"\.. "laugardagur"].. ::msgcat::mcset is MONTHS_ABBREV [list \.. "jan."\.. "feb."\.. "mar."\.. "apr."\.. "ma\u00ed"\.. "j\u00fan."\.. "j\u00fal."\.. "\u00e1g\u00fa."\.. "sep."\.. "okt."\.. "n\u00f3v."\.. "des."\.. ""].. ::msgcat::mcset is MONTHS_FULL [list \.. "jan\u00faar"\.. "febr\u00faar"\.. "mars"\.. "apr\u00edl"\.. "ma\u00ed"\.. "j\u00fan\u00ed"\.. "j\u00fal\

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\it.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1294
                                                                                                                                                                                                                                                Entropy (8bit):4.282101355195382
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83JYEVI2vfYpQjAOnhWBIIsmdC2lkOKk+Z+FoPJ6G3vesvY:43JZVB8eAOnh4IzR2+J6G/eKY
                                                                                                                                                                                                                                                MD5:3354A6FC06C298E33AA14163929E56EB
                                                                                                                                                                                                                                                SHA1:C3005370DAE8A266AE21F7E2B871AEA5A656A155
                                                                                                                                                                                                                                                SHA-256:1D72170B9F9028A237364F7CD7EA8B48BD4770E61922205CE862300103B13DE5
                                                                                                                                                                                                                                                SHA-512:58B64D4F5827CA2A1BF2DDFD1F7EFDDBBD46709A6A9B7277E8EB386D80043A87ADDE2B3D5A49A934E8EB8F797BD735FADA1D22AD3DD856FFE9507F71B9E45CBA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mer"\.. "gio"\.. "ven"\.. "sab"].. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \.. "domenica"\.. "luned\u00ec"\.. "marted\u00ec"\.. "mercoled\u00ec"\.. "gioved\u00ec"\.. "venerd\u00ec"\.. "sabato"].. ::msgcat::mcset it MONTHS_ABBREV [list \.. "gen"\.. "feb"\.. "mar"\.. "apr"\.. "mag"\.. "giu"\.. "lug"\.. "ago"\.. "set"\.. "ott"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset it MONTHS_FULL [list \.. "gennaio"\.. "febbraio"\.. "marzo"\.. "aprile"\.. "maggio"\.. "giugno"\.. "luglio"\.. "agosto"\.. "settembre"\.. "ottobre"\.. "novembre"\.. "dicembre"\.. "

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\it_ch.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):250
                                                                                                                                                                                                                                                Entropy (8bit):4.8982877714191035
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoi5jL/oyJ+3v1oia+3vjLtAsvn:4EnLB383b3F+3vV3v3tnn
                                                                                                                                                                                                                                                MD5:E4400C16406A46C2880250522BED2EDE
                                                                                                                                                                                                                                                SHA1:787A04037A355FF845025B8865335EB938280BFB
                                                                                                                                                                                                                                                SHA-256:24B5F303F5C7AF6F63FDC23ADB4D713087AE74B6D18C117D787AF03374C5F57E
                                                                                                                                                                                                                                                SHA-512:3551DEEF0EAAC66042143F77F2F4DD9154764F35BD624DAB3C9F0F59F3489CA39CE34BC2A69BC5BFBB1926C6F5C39D74A806ECB1A47F6B374101071957FD417B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y".. ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ja.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1689
                                                                                                                                                                                                                                                Entropy (8bit):4.951012555106795
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83Gl84OCtnbf3wvtMwvLv4GTwhvevTwSoXghGhD6h:43FULWttbdEVoES8gshD6h
                                                                                                                                                                                                                                                MD5:11FBE427747012444AEEAFD6134034A4
                                                                                                                                                                                                                                                SHA1:58C72C432053264EAE6335D6CC93C5FFA33C42B8
                                                                                                                                                                                                                                                SHA-256:2B6D15A191437F1B84FA7023E34153B61E6BF1DE1452EA921E9CCBBE5D4BEB1C
                                                                                                                                                                                                                                                SHA-512:4F993BDF5D50D6D9F7410C83D226FEF30BA8C989F9977A7025C36BE22CEECCD6C68CDD6AFC5C9CE3D700559C4EDC619042E14DD88EE7583B9D5AA66F0268FD23
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u6708"\.. "\u706b"\.. "\u6c34"\.. "\u6728"\.. "\u91d1"\.. "\u571f"].. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \.. "\u65e5\u66dc\u65e5"\.. "\u6708\u66dc\u65e5"\.. "\u706b\u66dc\u65e5"\.. "\u6c34\u66dc\u65e5"\.. "\u6728\u66dc\u65e5"\.. "\u91d1\u66dc\u65e5"\.. "\u571f\u66dc\u65e5"].. ::msgcat::mcset ja MONTHS_FULL [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"].. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d".. ::msgcat::mcset ja CE "\u897f\u66a6".. ::msgcat::mcset ja AM "\u5348\u524d".. ::msgcat::mcset ja PM "\u5348\u5f8c".. ::ms

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\kl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1025
                                                                                                                                                                                                                                                Entropy (8bit):4.097746630492712
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83E7XIE/OWbjH3Tw2PzJrIsmZ5maAXaMHPB:43WlrraA/vB
                                                                                                                                                                                                                                                MD5:2F79804667D6F8C77BB188D59EF5F3DF
                                                                                                                                                                                                                                                SHA1:10950ECA798F24A7C405B3E18B559CCC0C056EC1
                                                                                                                                                                                                                                                SHA-256:96FF17F1CFF976E4E204D3616D1EFCED4D0F907C5E6A0F04B4536CB4AD1190C9
                                                                                                                                                                                                                                                SHA-512:1B8ADC3B7FF920F8F53A17BFCC7EA24A0F8E276A42E5C63F9880DAE9B74E12716DD12DB647A80A9D99294449146C643EC58A33B03681AA4FA26A5FBC508C248C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \.. "sab"\.. "ata"\.. "mar"\.. "pin"\.. "sis"\.. "tal"\.. "arf"].. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \.. "sabaat"\.. "ataasinngorneq"\.. "marlunngorneq"\.. "pingasunngorneq"\.. "sisamanngorneq"\.. "tallimanngorneq"\.. "arfininngorneq"].. ::msgcat::mcset kl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset kl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "martsi"\.. "aprili"\.. "maji"\.. "juni"\.. "juli"\.. "augustusi"\.. "septemberi"\.. "oktoberi"\.. "novemberi"\.. "dece

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\kl_gl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.882476709336307
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoEpb53FuoEpLE3vLjoEpLE3v6mjoEpba+3vnFDoAkvn:4EnLB383jF3Fyw3vxw3v6A/3v9dmn
                                                                                                                                                                                                                                                MD5:255830678C8724E65C05A7E020E68B5B
                                                                                                                                                                                                                                                SHA1:0AEA48AB0439C04F92B5CA9A3B5182718B7F116B
                                                                                                                                                                                                                                                SHA-256:3027CFE9EBD2172CEFC15C025786CAD47A6E2894BF0474AFC1B0C341E70202AA
                                                                                                                                                                                                                                                SHA-512:99039FFA7269DD136D1693121E261DB5586E86EC401D2B1EB8FB1D13A9A7F1E514D9FC941B838286B986C02ED281828ED67E59002D837E350A64F4832340516A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y".. ::msgcat::mcset kl_GL TIME_FORMAT "%T".. ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T".. ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ko.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1621
                                                                                                                                                                                                                                                Entropy (8bit):4.612163420716489
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:43fMlylslXlslxl1hVuqLGuqqntH4xUyw9:2fKYqVq3f
                                                                                                                                                                                                                                                MD5:CCB2C2254D3FA3025183DB7E010CAD66
                                                                                                                                                                                                                                                SHA1:510BBB6A9162F2EF908E6561CC714848C2EA74CA
                                                                                                                                                                                                                                                SHA-256:EF6FB319C398EEA79B3A951319F831F3B186D556565D17D738E5F9B4B77570F2
                                                                                                                                                                                                                                                SHA-512:A0264565899BD1B0783ADC0388F893CCE713ADB23BDD63907CF092A74ACB4F7D3BE09DA29801E9C11A7B08CB1706E3771C598ACED351A0FCCBF4EBBD7871148D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \.. "\uc77c"\.. "\uc6d4"\.. "\ud654"\.. "\uc218"\.. "\ubaa9"\.. "\uae08"\.. "\ud1a0"].. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \.. "\uc77c\uc694\uc77c"\.. "\uc6d4\uc694\uc77c"\.. "\ud654\uc694\uc77c"\.. "\uc218\uc694\uc77c"\.. "\ubaa9\uc694\uc77c"\.. "\uae08\uc694\uc77c"\.. "\ud1a0\uc694\uc77c"].. ::msgcat::mcset ko MONTHS_ABBREV [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\.. "7\uc6d4"\.. "8\uc6d4"\.. "9\uc6d4"\.. "10\uc6d4"\.. "11\uc6d4"\.. "12\uc6d4"\.. ""].. ::msgcat::mcset ko MONTHS_FULL [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ko_kr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):354
                                                                                                                                                                                                                                                Entropy (8bit):5.058233326545794
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo56SFZhjAo56m5Ys5o56TGMovBo56a/W3v6mfKo56TT+3+:4EnLB383g62vjV6m5Ysg6TG26a+3v6oo
                                                                                                                                                                                                                                                MD5:58CA45CE26AF8ECA729BA72898BB633D
                                                                                                                                                                                                                                                SHA1:CBBEDB7370890A1DB65080A359A9A5C164B525D5
                                                                                                                                                                                                                                                SHA-256:4CAC8FB43D290A63A4D3215F22228B358AB4FA174F08712DD6C5B64C5E485071
                                                                                                                                                                                                                                                SHA-512:48CCBD3F7B96D0998B6D1A1F8D7FE2B4B070BB5B8809FABE0A38209AEAF2E95E098292A5B9B5F0954E7729708A2173D32AAD70B6C0F336DB1E9BFA2968E6A56B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804".. ::msgcat::mcset ko_KR CE "\uc11c\uae30".. ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d".. ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S".. ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\kok.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1997
                                                                                                                                                                                                                                                Entropy (8bit):4.202940482570495
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83cm48Vc7VczMmDNVcYVcR0prdSmS68FeDJVcYVcR0prdSmS68FeuT:4354a+0prjS68mq0prjS68pT
                                                                                                                                                                                                                                                MD5:67FA08F588A3B44D67E42EC1025013BC
                                                                                                                                                                                                                                                SHA1:6895FEF0476DE0349895DB052B335AC46636B23A
                                                                                                                                                                                                                                                SHA-256:9D215E31A39FED45B3657144E5F73C942E59E500036CE16B1FFF201FD6358595
                                                                                                                                                                                                                                                SHA-512:4C2708BD9DD98320D3133EEFFD19A8018F49A36AB8348DB7C0B0287ADB4C052D3EFAD3686C8E46E0520F3CE27F361978272BA8752EB04E5A7BC07780398480DB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \.. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset kok MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\kok_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):260
                                                                                                                                                                                                                                                Entropy (8bit):4.904340548436718
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo5VsNv+IZo5VsU3v6ry/5o5VsNo+3v+6f6HyFvn:4EnLB383gVsNvlAVsU3v6ry/gVsNF3vj
                                                                                                                                                                                                                                                MD5:0AA20289A63BA3A14DCFED75EED980DE
                                                                                                                                                                                                                                                SHA1:2B76013593D886B0724D82849FD1840B20922902
                                                                                                                                                                                                                                                SHA-256:644F2B6D4BA27AF14891B781DEF60F708A9F18FC2F73566649B631A6DEA3EF09
                                                                                                                                                                                                                                                SHA-512:6E13E0DC8BFD2ABE0D04B0BC098C40972F088F8D3D6ACA00338B17473ABC6F69840A88EC0C965C493B4270DEC777A0EA2D762BC33044EFE7030E437604EE201B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\kw.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1013
                                                                                                                                                                                                                                                Entropy (8bit):4.060027087416375
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83no1UwRlw4MAwBdc//3rpF6HFoot8:43vglHM7MTCHFs
                                                                                                                                                                                                                                                MD5:CCEC7B77DCA1F6A406311FC43EE57030
                                                                                                                                                                                                                                                SHA1:4ED329BB09A8F7C67F8984CD790E9B6819DE6F00
                                                                                                                                                                                                                                                SHA-256:EAB468AC5BF1833D4F8CD658789413D4A46CAD16B63FB9B906CFF6DC9EA26251
                                                                                                                                                                                                                                                SHA-512:4EFF6E49CC479A1BF0CEEAE256A1FAE7D4AE7D0ACE23CD87851471EC96BB5AF580C58A142E1B6CE72BC8B6BFF946A38801E681443B7DD9527A1DEB6E7EDD7D22
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \.. "Sul"\.. "Lun"\.. "Mth"\.. "Mhr"\.. "Yow"\.. "Gwe"\.. "Sad"].. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \.. "De Sul"\.. "De Lun"\.. "De Merth"\.. "De Merher"\.. "De Yow"\.. "De Gwener"\.. "De Sadorn"].. ::msgcat::mcset kw MONTHS_ABBREV [list \.. "Gen"\.. "Whe"\.. "Mer"\.. "Ebr"\.. "Me"\.. "Evn"\.. "Gor"\.. "Est"\.. "Gwn"\.. "Hed"\.. "Du"\.. "Kev"\.. ""].. ::msgcat::mcset kw MONTHS_FULL [list \.. "Mys Genver"\.. "Mys Whevrel"\.. "Mys Merth"\.. "Mys Ebrel"\.. "Mys Me"\.. "Mys Evan"\.. "Mys Gortheren"\.. "Mye Est"\.. "Mys Gwyngala"\.. "Mys Hedra"\.. "Mys Du"\.. "Mys Kevardhu"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\kw_gb.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.959913054070712
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoh6AvMoh633v6ay/5oh6Ao+3vR6HyFvn:4EnLB38346AvR633v6ay/46AF3voSVn
                                                                                                                                                                                                                                                MD5:18E8576F63B978F1AFEF15AC57B44FBF
                                                                                                                                                                                                                                                SHA1:D50EB90944FF81E3CBFF942B16C1874EB7EA2562
                                                                                                                                                                                                                                                SHA-256:EDAC14D929D1C6559EC46E9B460F8F44A189B78FB915F2D641104549CBD94188
                                                                                                                                                                                                                                                SHA-512:F3DE5EE77BB889DA1353F9C9A1811083AB28BBEE4B7D6C8782F38B1AE44CF77565371A0E18F7E2BACD7EF590BC1215CA3E41AF929A15F60B3E85F6099A4CF378
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\lt.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1307
                                                                                                                                                                                                                                                Entropy (8bit):4.506235846178408
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83iHYuAMLzHYCaNu3d3nT15T31FhAlDgK/YrDZ/6Qz2C9kGPCveksvc:43iHFnHuUd3/T3xM/+SQCC9kGPEekKc
                                                                                                                                                                                                                                                MD5:D4EC2E96995E0EB263F338DD16CC4F8D
                                                                                                                                                                                                                                                SHA1:7ED86175489B1AE3CA5C0E8D42969F951C895D6B
                                                                                                                                                                                                                                                SHA-256:855B652FCC8066BA45C7DC8DBFD3807D1B4759EA8D71C523567F47BF445D1DE6
                                                                                                                                                                                                                                                SHA-512:A55E0D759A22360FF6668CEFAFFB812BABB316C447ADDB1FD5CDBC06AE1DA2E891E09952D073164C013AD9BF4184614102E7ADA553EEEFB2BBA26208B79B277F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \.. "Sk"\.. "Pr"\.. "An"\.. "Tr"\.. "Kt"\.. "Pn"\.. "\u0160t"].. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \.. "Sekmadienis"\.. "Pirmadienis"\.. "Antradienis"\.. "Tre\u010diadienis"\.. "Ketvirtadienis"\.. "Penktadienis"\.. "\u0160e\u0161tadienis"].. ::msgcat::mcset lt MONTHS_ABBREV [list \.. "Sau"\.. "Vas"\.. "Kov"\.. "Bal"\.. "Geg"\.. "Bir"\.. "Lie"\.. "Rgp"\.. "Rgs"\.. "Spa"\.. "Lap"\.. "Grd"\.. ""].. ::msgcat::mcset lt MONTHS_FULL [list \.. "Sausio"\.. "Vasario"\.. "Kovo"\.. "Baland\u017eio"\.. "Gegu\u017e\u0117s"\.. "Bir\u017eelio"\.. "Liepos"\.. "Rugpj\u016b\u010dio"\.. "Rugs\u0117jo"\.. "Spa

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\lv.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1271
                                                                                                                                                                                                                                                Entropy (8bit):4.460631492946299
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83Amshb4mZdA7nl9kMmfpK269rkbi5vWm0W9ARivirXsv05vkn:430bHA7XRr95QWQQgaKkn
                                                                                                                                                                                                                                                MD5:554ED2CAFD25F5F82DA54AE057F4BA98
                                                                                                                                                                                                                                                SHA1:E25CDF0F9C4B523B5B05408E7820F7B4F627D19E
                                                                                                                                                                                                                                                SHA-256:7E90D2008B220DB19C796C7107AD69D263B8AC8C7BDDFB879230699D978E9A0A
                                                                                                                                                                                                                                                SHA-512:612201CCD64A51EC943921196D8C74D8BCA3AB3E35B0C9E91AE7F3A6B36F4F255AA9ADB3A254EC03629B01BD221B0B3F8CC4DFBFAC1F1718775E81CAD188AA86
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \.. "Sv"\.. "P"\.. "O"\.. "T"\.. "C"\.. "Pk"\.. "S"].. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \.. "sv\u0113tdiena"\.. "pirmdiena"\.. "otrdiena"\.. "tre\u0161diena"\.. "ceturdien"\.. "piektdiena"\.. "sestdiena"].. ::msgcat::mcset lv MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maijs"\.. "J\u016bn"\.. "J\u016bl"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset lv MONTHS_FULL [list \.. "janv\u0101ris"\.. "febru\u0101ris"\.. "marts"\.. "apr\u012blis"\.. "maijs"\.. "j\u016bnijs"\.. "j\u016blijs"\.. "augusts"\.. "septembris"\.. "oktobris"\.. "novembris"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\mk.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2157
                                                                                                                                                                                                                                                Entropy (8bit):4.299300188052441
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:4389QMsGqdQfRQPjQmofqJp9sk5BstSpWQiQ3QJQ5QL39I0QRQTQ8Ql4J8W:2W8SMq+9sWINi2Kc9I0+gXF
                                                                                                                                                                                                                                                MD5:888014F13A82511ABEF99497A753BFC3
                                                                                                                                                                                                                                                SHA1:7F4231BEDE191370B37E8B917B6AD8829D15CA7D
                                                                                                                                                                                                                                                SHA-256:4C0EB07F0FCB36DD12A3F7EDD6531616611ABF62BF7705B5A37CC59098221D5D
                                                                                                                                                                                                                                                SHA-512:D748127CC615584901D35B6492EC566448B6C4DA6363858B5145921E9CD09490355CF4315F0F7A8542AA12790CD3432011A643A3A8F74B0119DB0DCE19FD68A4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0435\u0434."\.. "\u043f\u043e\u043d."\.. "\u0432\u0442."\.. "\u0441\u0440\u0435."\.. "\u0447\u0435\u0442."\.. "\u043f\u0435\u0442."\.. "\u0441\u0430\u0431."].. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0435\u043b\u0430"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\.. "\u043f\u0435\u0442\u043e\u043a"\.. "\u0441\u0430\u0431\u043e\u0442\u0430"].. ::msgcat::mcset mk MONTHS_ABBREV [list \.. "\u0458\u0430\u043d."\.. "\u0444\u0435\u0432."\.. "\u043c\u0430\u0440."\.. "\u0430\u043f\u0440."\.. "\u043c\u0430\u0458."\.. "\u0458\u0443\u

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\mr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1846
                                                                                                                                                                                                                                                Entropy (8bit):4.220147808639664
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR833cXh48Vc7VczfVczPmzNVcYVcR0prdSmS68FezUVcYVcR0prdSmS68FeoV:43K4S+0prjS68Yh0prjS68nV
                                                                                                                                                                                                                                                MD5:07F99E0A05083B10F80A4D6867163B23
                                                                                                                                                                                                                                                SHA1:B6036C7DA8043E3401583D03831E7A4BF755D93D
                                                                                                                                                                                                                                                SHA-256:AE873BF5484EACBBE179913D43451BE53378FA701B5D81594D052266B8A09AF0
                                                                                                                                                                                                                                                SHA-512:3A032C81B8FBFEE6EB66C1538CBD16329A1B393E4684B4E9B3FBCDD6344CE8AD34FA699F76EF953B3EB597D8E253345F54C2E92E7A43611C721038BCC2471EA2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset mr MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\u091f\u0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\mr_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.89440333975705
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoGNv+IZoGU3v6ry/5oGNo+3v+6f6HyFvn:4EnLB383Zvlw3v6ry/ZF3vmSVn
                                                                                                                                                                                                                                                MD5:67368E8A5715860BABD44E54A168192F
                                                                                                                                                                                                                                                SHA1:7790D4B4B28FE5E38AB11CD037FFB826A8EB77FD
                                                                                                                                                                                                                                                SHA-256:B7B1D379355A1D278E13EF557A887A662E84FB6A9B62B8E19A27927926270EF9
                                                                                                                                                                                                                                                SHA-512:E95C90CFFA7CC4E61026FC328A4AA0BEE6A54A0061BA0B9459F9F0F4B008DD36F81BC9B8D8B964FA051FCEAB7FECE6D107CD456B3FD01A83B4900ECC3A0BCFA4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ms.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):957
                                                                                                                                                                                                                                                Entropy (8bit):4.018924167342869
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:4EnLB383Zm/aufodZmt+JHEA7UVRosmAL/7Idzr43xRRosuL1PJHWZ6tHhHjv:4aR83ZsauSHJkA7umE/72UD21PJWZ0hT
                                                                                                                                                                                                                                                MD5:7E6A943B7D82404F61BDBD95682073CD
                                                                                                                                                                                                                                                SHA1:B96DBB1738F293D2842FDCEDF2DEF13004F77A8D
                                                                                                                                                                                                                                                SHA-256:970B2F3ECC04980FCC2F9531CA6CE2BF36BC12942CB614BF70313B4CB0508985
                                                                                                                                                                                                                                                SHA-512:12F5A5F7A170EE79D1F4398E96FF2DE84472027C5B5003DE7E86F46713E3F0997439E2EBA03FFB7DB611F0CE0E06EB149F5BD08ED2AA0409DB8348867487FFFD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \.. "Aha"\.. "Isn"\.. "Sei"\.. "Rab"\.. "Kha"\.. "Jum"\.. "Sab"].. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \.. "Ahad"\.. "Isnin"\.. "Selasa"\.. "Rahu"\.. "Khamis"\.. "Jumaat"\.. "Sabtu"].. ::msgcat::mcset ms MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mac"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ogos"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dis"\.. ""].. ::msgcat::mcset ms MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Mac"\.. "April"\.. "Mei"\.. "Jun"\.. "Julai"\.. "Ogos"\.. "September"\.. "Oktober"\.. "November"\.. "Disember"\.. ""]..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ms_my.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):265
                                                                                                                                                                                                                                                Entropy (8bit):4.818053174805798
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoChFfluoChF+3v6xyFjoCh++3vflm68vn:4EnLB383xPflwe3v6gZl3vflm6+n
                                                                                                                                                                                                                                                MD5:A02F11BE0DF920E63E7A3ACCE746E32D
                                                                                                                                                                                                                                                SHA1:4A8B1EF1A6F8A5FD022042D6E009A01E4B0FEBD3
                                                                                                                                                                                                                                                SHA-256:F5B859D8DD2A2B5F756E39B0DFEB26B95878D2F54BA3CE46C56F0F26CF2B554B
                                                                                                                                                                                                                                                SHA-512:5F9AF8C89F491CB4C158ED73EA4CF32E6A83CF44A94DA6FE1A962C58199BF2348530F3DEFA0C6F433BA3ADEF81AE9B3884F30CD7A841B159D52F9F21008B4F92
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\mt.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):717
                                                                                                                                                                                                                                                Entropy (8bit):4.55153350337982
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:4EnLB383VYmxWHWog4QUbxMmAMMiGZu+3v6ay/GK3vZsSVn:4aR83VYsxonQ2MmVVGRvjCGsvGSV
                                                                                                                                                                                                                                                MD5:D8BBEC2F8935054E6081BB5E4AE8F7E3
                                                                                                                                                                                                                                                SHA1:33FE6D51A284B8760BC6F442329B10374F506BDA
                                                                                                                                                                                                                                                SHA-256:7DBC4E82D82FDE8CDF522FA10E082289D46B0C1A4A7D7A5FA83FF116677F052B
                                                                                                                                                                                                                                                SHA-512:BF39C75DD6B3625897D7D44AC253AF5656CA21D0B394F78611584E2606CBC419C4A02353542D23393BEBCCF0CB4D861CDECD61AD89339F78C0260E966B495777
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \.. "\u0126ad"\.. "Tne"\.. "Tli"\.. "Erb"\.. "\u0126am"\.. "\u0120im"].. ::msgcat::mcset mt MONTHS_ABBREV [list \.. "Jan"\.. "Fra"\.. "Mar"\.. "Apr"\.. "Mej"\.. "\u0120un"\.. "Lul"\.. "Awi"\.. "Set"\.. "Ott"\.. "Nov"].. ::msgcat::mcset mt BCE "QK".. ::msgcat::mcset mt CE "".. ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y".. ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\nb.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1209
                                                                                                                                                                                                                                                Entropy (8bit):4.313626715960843
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83B0tSYuZrIsmYmPAxyIQ4HU92W16EL3Tvav31:43qhuZrIPAt04yTcF
                                                                                                                                                                                                                                                MD5:42D02C3CAF28BE4994F27CEF5A183AB7
                                                                                                                                                                                                                                                SHA1:DC411E8AC12C3D588AB2F3A3C95A75D8689AD402
                                                                                                                                                                                                                                                SHA-256:534C5DACEF12F818FAF4ED806997A559F95D591F1B6236B0C30B07A107DD13F3
                                                                                                                                                                                                                                                SHA-512:0BE27572106324FE2B6CDFF4513500DE7582AD1ABEF451FFC62B2050D3875A149DDDB66451E1B3F5BA9216268E9998D2A1C1E8343BBB9EF97947DA054B82818E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset nb MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nb MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nb BC

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\nl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1129
                                                                                                                                                                                                                                                Entropy (8bit):4.235969198645435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR837Ed+RxRMZZsmUmnZAEEHM92WFU5vtrvs:43AAHRMZZPnZALsCtt7s
                                                                                                                                                                                                                                                MD5:B9B949794203D204628D4DBEA29587AE
                                                                                                                                                                                                                                                SHA1:1642D8040144469B5C359E80693E68036F87B849
                                                                                                                                                                                                                                                SHA-256:9E2FE3851CF13EC79A9B10A09B01CEB0A26044AE0DC90A4E00BE57745E854C79
                                                                                                                                                                                                                                                SHA-512:0CCCCF6D61423CEE0389C3BA1A8E94F2B092C53465D1937F5595AF91E46DD38B318D6C7EE3D88B89F32BFB952C0D55E0E67B46D7DF306ECA6690E283ADEB2CB9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \.. "zo"\.. "ma"\.. "di"\.. "wo"\.. "do"\.. "vr"\.. "za"].. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \.. "zondag"\.. "maandag"\.. "dinsdag"\.. "woensdag"\.. "donderdag"\.. "vrijdag"\.. "zaterdag"].. ::msgcat::mcset nl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mrt"\.. "apr"\.. "mei"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset nl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "maart"\.. "april"\.. "mei"\.. "juni"\.. "juli"\.. "augustus"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset nl DATE_FORM

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\nl_be.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.865165930946383
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xo4gPPdjog9X3vLjog9X3v6mjo49+3vnFDoAkvn:4EnLB3835gHdPF3vjF3v64I3v9dmn
                                                                                                                                                                                                                                                MD5:3261F397ED0291368FF1881E7BA08ECE
                                                                                                                                                                                                                                                SHA1:7147ABB62034EB152B1FED9246A533535F07372C
                                                                                                                                                                                                                                                SHA-256:77A69DD60D171B321512B14794E75A66FF753410C007997B310790D86E09B057
                                                                                                                                                                                                                                                SHA-512:C1526F454FA594DAD056B056F76F01D8B2AB713D04EB2A3643416B8E741B248CC94E000BAEE5B0F60436B88B1216FB1DE7F7C3FA456D4A4FBDE24F97C3B739B8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y".. ::msgcat::mcset nl_BE TIME_FORMAT "%T".. ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\nn.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1200
                                                                                                                                                                                                                                                Entropy (8bit):4.282788574144479
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83tCtrJwuQrIsmYmLAxyIQ4HU92W1W4/3Hv+v31:434suQrILAt0EafIF
                                                                                                                                                                                                                                                MD5:985E97517C2BF37719A618F575DF392C
                                                                                                                                                                                                                                                SHA1:65BC07FC3A955300ED09B7485F90AEC18CBAD43F
                                                                                                                                                                                                                                                SHA-256:06FA2D6D8C59D0B8EAC2EDE5AB0DDB8B6E095D1A023B1966FCE3B65916FA14FB
                                                                                                                                                                                                                                                SHA-512:75BC14DBAD147A98D32D2AF0BE0BE50F115BB9C3BBE283B53977B9F264A055734B30F6B1C4EEE9686F1874D178C535111731C92D495B7D370FB17213B65C9A40
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "m\u00e5"\.. "ty"\.. "on"\.. "to"\.. "fr"\.. "lau"].. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \.. "sundag"\.. "m\u00e5ndag"\.. "tysdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "laurdag"].. ::msgcat::mcset nn MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nn MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nn BCE "f.Kr."

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\pl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1263
                                                                                                                                                                                                                                                Entropy (8bit):4.459506202908786
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83lUj0ORGgIzdW6RDYKG7FwRc0ypvOvX:43+HMg2W6RDYnFwRc0ydYX
                                                                                                                                                                                                                                                MD5:79AB7C13AA3833A1DAEADDB1144CCE55
                                                                                                                                                                                                                                                SHA1:C01ABC2F16549CAEC6B081448B2CBA88A680E250
                                                                                                                                                                                                                                                SHA-256:61462C325DB0065352D8155307F949869862A86CAC67AD7BB6703F57A7FA2FF3
                                                                                                                                                                                                                                                SHA-512:79EB696164FDDD9B121558C2780E54E295FF2DC4D8E87A0DE507B4F2925612721A98FF5010199CB68CF894ACA7A07884E9E02F3DC1E078D241431E3DC884C0A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \.. "N"\.. "Pn"\.. "Wt"\.. "\u015ar"\.. "Cz"\.. "Pt"\.. "So"].. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \.. "niedziela"\.. "poniedzia\u0142ek"\.. "wtorek"\.. "\u015broda"\.. "czwartek"\.. "pi\u0105tek"\.. "sobota"].. ::msgcat::mcset pl MONTHS_ABBREV [list \.. "sty"\.. "lut"\.. "mar"\.. "kwi"\.. "maj"\.. "cze"\.. "lip"\.. "sie"\.. "wrz"\.. "pa\u017a"\.. "lis"\.. "gru"\.. ""].. ::msgcat::mcset pl MONTHS_FULL [list \.. "stycze\u0144"\.. "luty"\.. "marzec"\.. "kwiecie\u0144"\.. "maj"\.. "czerwiec"\.. "lipiec"\.. "sierpie\u0144"\.. "wrzesie\u0144"\.. "pa\u017adziernik"\.. "listopad"\..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\pt.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1177
                                                                                                                                                                                                                                                Entropy (8bit):4.394980756969744
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83CYkjBc1yHYJt//0/I31YMY47flV7YaqgCyt9Fo8g6Gtvt76svi:43C5LHcNnxJ9Ltg6Gpt76Ki
                                                                                                                                                                                                                                                MD5:8F53B3571DD29E12BD33349CFA32F28F
                                                                                                                                                                                                                                                SHA1:C125E059B8BFE5FECD482D1A1DA50B8678872BF6
                                                                                                                                                                                                                                                SHA-256:6F6EEEDDCF232BDCB952592A144810CED44A1CBB4BCC2C062D5F98D441505380
                                                                                                                                                                                                                                                SHA-512:5CD7E7097B720E5399795126A71348816CBA697FD8F14160779E982ADAB00D5994978E2F9445785B0DE62F6F14232278AD1A65BC53730CA58D676B057F0BC406
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Seg"\.. "Ter"\.. "Qua"\.. "Qui"\.. "Sex"\.. "S\u00e1b"].. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Segunda-feira"\.. "Ter\u00e7a-feira"\.. "Quarta-feira"\.. "Quinta-feira"\.. "Sexta-feira"\.. "S\u00e1bado"].. ::msgcat::mcset pt MONTHS_ABBREV [list \.. "Jan"\.. "Fev"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset pt MONTHS_FULL [list \.. "Janeiro"\.. "Fevereiro"\.. "Mar\u00e7o"\.. "Abril"\.. "Maio"\.. "Junho"\.. "Julho"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Dezembro"

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\pt_br.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):286
                                                                                                                                                                                                                                                Entropy (8bit):4.8608779725401785
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xofm6GPWWjofAW3vLjofAW3v6mjofm6T+3vnFDoAkvn:4EnLB383+NGdg93vk93v6fNK3v9dmn
                                                                                                                                                                                                                                                MD5:A2626EA95C2480FEA68906AE6A1F6993
                                                                                                                                                                                                                                                SHA1:A0592902337C00FC2E70B1DFB3A42453A86535BB
                                                                                                                                                                                                                                                SHA-256:320BE7D5B730091E6FA35F196314737261C8E154577DCF6AC8C2057D44394AD7
                                                                                                                                                                                                                                                SHA-512:9801A87D024565676D4F3EAF0702C213E59FC2B6719D8BE95C19C9ED53FC43487F65F5408378B401A2B4C2BD4E2E391C2D848CA87739A6082AB7766EC6B9EFE1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset pt_BR TIME_FORMAT "%T".. ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T".. ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ro.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1224
                                                                                                                                                                                                                                                Entropy (8bit):4.350784108088039
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83coPUMSeZmkTMm41icpK+7ZVoImEcVUCWdvHvWIn:43lPHFmkm1iMVoxEc+CWZPWIn
                                                                                                                                                                                                                                                MD5:F6575EC17966320106FF7ABDFB3186E2
                                                                                                                                                                                                                                                SHA1:68C6B72D664FDA27450FCE8B5734AB627CE825D7
                                                                                                                                                                                                                                                SHA-256:25ED6AC7A353E23B954B98611AE3B7E56BDCF2B0CB0DB358253CFB8BEBBB831C
                                                                                                                                                                                                                                                SHA-512:E564543231922A17C898419545BFA65E5E31FE9F005FDD201B735CFDE08E96FB3B98349C2A7959E29CA8F7E6934B0C4C6DE6B5E67209D0DD9A7746DFEBF037B3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \.. "D"\.. "L"\.. "Ma"\.. "Mi"\.. "J"\.. "V"\.. "S"].. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \.. "duminic\u0103"\.. "luni"\.. "mar\u0163i"\.. "miercuri"\.. "joi"\.. "vineri"\.. "s\u00eemb\u0103t\u0103"].. ::msgcat::mcset ro MONTHS_ABBREV [list \.. "Ian"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mai"\.. "Iun"\.. "Iul"\.. "Aug"\.. "Sep"\.. "Oct"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset ro MONTHS_FULL [list \.. "ianuarie"\.. "februarie"\.. "martie"\.. "aprilie"\.. "mai"\.. "iunie"\.. "iulie"\.. "august"\.. "septembrie"\.. "octombrie"\.. "noiembrie"\.. "decembrie"\.. ""].. ::msgcat:

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ru.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2091
                                                                                                                                                                                                                                                Entropy (8bit):4.2886524607041006
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:43D+pQ7keidQfRQPgQHB81Z/sFIAZSQWQXQrQxJQjQRnQBFQiWftkWt:26pgkeoSnpjA4tMYiJcCMFmVRt
                                                                                                                                                                                                                                                MD5:9F1C8DD58550558977821FD500E7C0E0
                                                                                                                                                                                                                                                SHA1:EFDD809BC2872A5BE0E353D31BE6D7D72E4B829C
                                                                                                                                                                                                                                                SHA-256:BB35BB6F07BAEF72C329EC3E95D6527A2736070EE2FFE5DE227E1FF0332390F8
                                                                                                                                                                                                                                                SHA-512:AA3C5C40AE9D342F8287958355C3321CF60566AD3E84E3D18D782FC022A998DA275506A61010A65D2E7D7578F2919C47C63AB0BA63A38800AA48D4B88ACE54D3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \.. "\u0412\u0441"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \.. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\.. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\.. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"].. ::msgcat::mcset ru MONTHS_ABBREV [list \.. "\u044f\u043d\u0432"\.. "\u0444\u0435\u0432"\.. "\u043c\u0430\u0440"\.. "\u0430\u043f\u0440"\.. "\u043c\u0430\u0439"\.. "\u0438\u044e\u

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ru_ua.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):248
                                                                                                                                                                                                                                                Entropy (8bit):4.9420431225061
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoVAgWIZoVY9X3vtfNrsoVA9+3vW6Q9vn:4EnLB383SFWIyaX3vtNl/3vWHNn
                                                                                                                                                                                                                                                MD5:DC98D88964650E302BE97FDB3B33326E
                                                                                                                                                                                                                                                SHA1:1DDDCC4265D7B980B867FEE674BEF2FD87D823F7
                                                                                                                                                                                                                                                SHA-256:13E4E79A0ED82034BADE0CFF8DEF5DE1222F6968108AD710662BDB7DAF36D7E1
                                                                                                                                                                                                                                                SHA-512:F3B9D528C529DD520FEDA3C20ED354E521C5B3C29F3317E15B7939CE06A3D67554D34DD6E54FE038585E46C560C604A1FD7E7F84914086B5994D52CE2C9E99CE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y".. ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\sh.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1212
                                                                                                                                                                                                                                                Entropy (8bit):4.359036493565628
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83/YIXo4YY0dD6kMm7fX2NaSIvZdHZgHZ/IxvaGWxvtl9svWTN:43rLTR44/yWltOWB
                                                                                                                                                                                                                                                MD5:E297221FA73BD78577B398BC7D061D21
                                                                                                                                                                                                                                                SHA1:F2A6B456272F913A9E97C495CEE73AC774C90FA1
                                                                                                                                                                                                                                                SHA-256:E65D6E5E837DF0A2DF0DB77BCE45334BBC27EFFF9023C37119E75D49932D9D6C
                                                                                                                                                                                                                                                SHA-512:AB9DDAE7CB21193C7753041F0B88CF2D40987E7E604B47816219458D217F084AA4EBF36719E22AAB3FD71A271D9F956ADC353182991903D7ADE8C8F00F6B2F9B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Uto"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sub"].. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljak"\.. "Utorak"\.. "Sreda"\.. "\u010cetvrtak"\.. "Petak"\.. "Subota"].. ::msgcat::mcset sh MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maj"\.. "Jun"\.. "Jul"\.. "Avg"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset sh MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "Mart"\.. "April"\.. "Maj"\.. "Juni"\.. "Juli"\.. "Avgust"\.. "Septembar"\.. "Oktobar"\.. "Novembar"\.. "Decembar"\.. ""].. ::msgcat::mcset sh BC

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\sk.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1255
                                                                                                                                                                                                                                                Entropy (8bit):4.4043119723436135
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83c46o40u3rIsmJIcm93ApLDVb2IcU95WFGEXF3eUCvtz/v3e6:43c3ow3rF93Ap7tEXFREtznp
                                                                                                                                                                                                                                                MD5:24DA40901D907D35195CC1B3A675EBC7
                                                                                                                                                                                                                                                SHA1:8AF31248F06FADA5CFB0D83A940CFF5CE70E2577
                                                                                                                                                                                                                                                SHA-256:976813F6C53C9BEBBF976B0F560FD7FC5E4EC4C574D7E1CD31F9A4056765CB7A
                                                                                                                                                                                                                                                SHA-512:A9BC6AAFE9AEEDFD1E483E54A2D27871A09ADD6807D8F90410CD2BB82A91BA9DF435652EC9A7C3AD0A080D7F153CA848BB47DAD3936BA30E4AEFF3C474C433CC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "Ut"\.. "St"\.. "\u0160t"\.. "Pa"\.. "So"].. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \.. "Nede\u013ee"\.. "Pondelok"\.. "Utorok"\.. "Streda"\.. "\u0160tvrtok"\.. "Piatok"\.. "Sobota"].. ::msgcat::mcset sk MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sk MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "marec"\.. "apr\u00edl"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "august"\.. "september"\.. "okt\u00f3ber"\.. "november"\.. "decem

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\sl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1216
                                                                                                                                                                                                                                                Entropy (8bit):4.333705818952628
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83MIXpC9opYuGS/BrIsmZ5hv1yAxyIVjd392WFThENvt0vJoO:43fXYujZrqyApYJtyR
                                                                                                                                                                                                                                                MD5:CB76F54CBE0D1AAE8BA956B4C51CBD2A
                                                                                                                                                                                                                                                SHA1:C1F78375EDB0BD2504553E33B2024C0C63FDB1B2
                                                                                                                                                                                                                                                SHA-256:11A6264676DBED87E4F718075127E32E107854F35F141642454F484984084486
                                                                                                                                                                                                                                                SHA-512:69964348FF08DE6EEB5E3DD61057FF0DF5441105EB7BEE7FB7E9AC5E26DCC164E3C7C011CA5CD7BC5B97A7872532331C97CCBC80563F6C5A3548014BFA8BEF16
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Tor"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sob"].. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljek"\.. "Torek"\.. "Sreda"\.. "\u010cetrtek"\.. "Petek"\.. "Sobota"].. ::msgcat::mcset sl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "avg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sl MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marec"\.. "april"\.. "maj"\.. "junij"\.. "julij"\.. "avgust"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset sl B

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\sq.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1321
                                                                                                                                                                                                                                                Entropy (8bit):4.408176575111904
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83F7ONQEwXwjjTlVoSEh76W/X+WZQJ4hv+H6v2V:43NwjPEwl4VQ8q
                                                                                                                                                                                                                                                MD5:E606F620F03EC0FBDBE6551601299C5F
                                                                                                                                                                                                                                                SHA1:0B50AB679E8D90D8E7319BCADAC426E004594D3B
                                                                                                                                                                                                                                                SHA-256:1F4EFD78F6B45B65F73F09B2F52FC13C2A7C4138DCB7664804878D197B6EBDF9
                                                                                                                                                                                                                                                SHA-512:08AF2B51EB7111E334ADDA3A03F9A8816C104E9742B523EC363FB5131A3DF73D298A8DDCD573D23C23C65CCFD2B8898DF75AE3D4F04BF80744044FB6BAB5EC0A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \.. "Die"\.. "H\u00ebn"\.. "Mar"\.. "M\u00ebr"\.. "Enj"\.. "Pre"\.. "Sht"].. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \.. "e diel"\.. "e h\u00ebn\u00eb"\.. "e mart\u00eb"\.. "e m\u00ebrkur\u00eb"\.. "e enjte"\.. "e premte"\.. "e shtun\u00eb"].. ::msgcat::mcset sq MONTHS_ABBREV [list \.. "Jan"\.. "Shk"\.. "Mar"\.. "Pri"\.. "Maj"\.. "Qer"\.. "Kor"\.. "Gsh"\.. "Sht"\.. "Tet"\.. "N\u00ebn"\.. "Dhj"\.. ""].. ::msgcat::mcset sq MONTHS_FULL [list \.. "janar"\.. "shkurt"\.. "mars"\.. "prill"\.. "maj"\.. "qershor"\.. "korrik"\.. "gusht"\.. "shtator"\.. "tetor"\.. "n\u00ebntor"\.. "dhjetor"\.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\sr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2087
                                                                                                                                                                                                                                                Entropy (8bit):4.307749748884122
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:43ilQTSBQrQP9QenzMKSFD9NI/QiNQEQrQL1KKYjU5rtAx:2I5EyLMKSFZNIYMzYMKKiqW
                                                                                                                                                                                                                                                MD5:BF363AB60B57F6D8FDCDBFD230A28DDF
                                                                                                                                                                                                                                                SHA1:6375CBA0A2197DA7E65BEE45C42F02C4F0B9142D
                                                                                                                                                                                                                                                SHA-256:FA00A7B22C9941F6C2B893F22B703DCB159CA2F2E4005FD6A74A632AEB786BFA
                                                                                                                                                                                                                                                SHA-512:91AD8085EF321A5A0E4D2ED204940CB66E8E230BBEDE59A8A07D1CEED9155FCC6B075A1FCC44AE834C1FEEEB3A59256C4310684C5AC453D4C50DFABD88469814
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0435\u0434"\.. "\u041f\u043e\u043d"\.. "\u0423\u0442\u043e"\.. "\u0421\u0440\u0435"\.. "\u0427\u0435\u0442"\.. "\u041f\u0435\u0442"\.. "\u0421\u0443\u0431"].. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u0459\u0430"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\.. "\u0423\u0442\u043e\u0440\u0430\u043a"\.. "\u0421\u0440\u0435\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\.. "\u041f\u0435\u0442\u0430\u043a"\.. "\u0421\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset sr MONTHS_ABBREV [list \.. "\u0408\u0430\u043d"\.. "\u0424\u0435\u0431"\.. "\u041c\u0430\u0440"\.. "\u0410\u043f\u0440"\.. "\u041c\u0430\u0458"\.. "\u0408\u0443\u043d"\.. "\

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\sv.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1219
                                                                                                                                                                                                                                                Entropy (8bit):4.3542418837714285
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83qoLt6yLQoAusrIsmZ5m4AcjTHX92WFfjr4MvBvX:43ZLxQNusrr4Aw3Jkq1X
                                                                                                                                                                                                                                                MD5:3B5C3FFA0829768470BDA1B46D882060
                                                                                                                                                                                                                                                SHA1:C96799036EC5CCDE799A6B50CD7748908935A2F3
                                                                                                                                                                                                                                                SHA-256:483916B51BD7E071E88F9EC36AAF3E08FEA823991532F832DE491C6C40B55A9F
                                                                                                                                                                                                                                                SHA-512:684FA249123878AA7F856DF0FD3B0D9F041113CFEA8EEFA47D0E1948DA23694330BF0D62BA896A3891CD559C16CAE9330BF31508F530AC003D2929D5FD9246D8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \.. "s\u00f6"\.. "m\u00e5"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f6"].. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \.. "s\u00f6ndag"\.. "m\u00e5ndag"\.. "tisdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f6rdag"].. ::msgcat::mcset sv MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sv MONTHS_FULL [list \.. "januari"\.. "februari"\.. "mars"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "augusti"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat:

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\sw.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1040
                                                                                                                                                                                                                                                Entropy (8bit):4.108744949579904
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:4EnLB383A4mScvhkzoR4mtuWckRkoay3UVxMmALfG7IdzVJ633xRCPLMYMvYo76u:4aR83/Shkz1uckO76kMmEf62qOTdMvvn
                                                                                                                                                                                                                                                MD5:5774860C8AEECBD48F1502E616158CAB
                                                                                                                                                                                                                                                SHA1:DE7059713EA7913A0C79F5386833CE2BCAD2CFD7
                                                                                                                                                                                                                                                SHA-256:1DA068C9AA02EF14A2440758C6040D632D96044A20EC501DBB9E40D8592E0E7F
                                                                                                                                                                                                                                                SHA-512:91E69222DDF55E9E0E389DB77D7A0F2E082351DC3FB34A1A2C1E350E4187E8BB940F6C2EDE1B8651159C2787AA0BE4D7268F33F7A82CAED03514FCE462530408
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \.. "Jpi"\.. "Jtt"\.. "Jnn"\.. "Jtn"\.. "Alh"\.. "Iju"\.. "Jmo"].. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \.. "Jumapili"\.. "Jumatatu"\.. "Jumanne"\.. "Jumatano"\.. "Alhamisi"\.. "Ijumaa"\.. "Jumamosi"].. ::msgcat::mcset sw MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset sw MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Machi"\.. "Aprili"\.. "Mei"\.. "Juni"\.. "Julai"\.. "Agosti"\.. "Septemba"\.. "Oktoba"\.. "Novemba"\.. "Desemba"\.. ""].. ::msgcat::mcset sw BCE "

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ta.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1874
                                                                                                                                                                                                                                                Entropy (8bit):4.080580566597515
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83AI0xnJdnQhmHlHYPKtul+eOPfIxyH5ztUSLu8tptLtrl+eOPfIxyH5ztUSU:43N0dQmHlHYPKtu1HxMtr1Hx/
                                                                                                                                                                                                                                                MD5:85288236C3997302EA26D7403BBA2C15
                                                                                                                                                                                                                                                SHA1:05AB389CC4DCF17B37BFF6ED1ECD58D6E9850A01
                                                                                                                                                                                                                                                SHA-256:AEFDC4255890D5B3FFE5CEE1B457B7D711283C2287ABA644155C10956012F6C1
                                                                                                                                                                                                                                                SHA-512:8E389D46606176EE14B8356153095B49C9426B80139B672A620F488891F091D1A272D4FB116775900E4AB4EC84DDDEBD8D6AF81AC672F14F148F2BFC638D2B10
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \.. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\.. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\.. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\.. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\.. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\.. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\.. "\u0b9a\u0ba9\u0bbf"].. ::msgcat::mcset ta MONTHS_ABBREV [list \.. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\.. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\.. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\.. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\.. "\u0bae\u0bc7"\.. "\u0b9c\u0bc2\u0ba9\u0bcd"\.. "\u0b9c\u0bc2\u0bb2\u0bc8"\.. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\.. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\.. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\ta_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):257
                                                                                                                                                                                                                                                Entropy (8bit):4.863003494480733
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xosDv+IZosK3v6ry/5osDo+3v+6f6HyFvn:4EnLB383ZDvl5K3v6ry/ZDF3vmSVn
                                                                                                                                                                                                                                                MD5:CF078352DA0507C767F04E31D6C14296
                                                                                                                                                                                                                                                SHA1:0A9B1255BD85B60D3620AE61370F54748AB7A182
                                                                                                                                                                                                                                                SHA-256:4978A193076DE56944236F7F1DCECACFF739536DFB3DBEFC1F7FE2B97A8AEAF4
                                                                                                                                                                                                                                                SHA-512:6FFC85B2A8DECB373EC76B1CD1A9459A30E443319F2C8DB9BBE6E115F5EFEEBAC314D4E8BE996EA55EE46466C6F6057A73078F5FDCF1C4CBAF1A270E45BC10C0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\te.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2149
                                                                                                                                                                                                                                                Entropy (8bit):4.097884113767283
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:43a8mxI9k3JR0UjjFbPcniLHVktjjFbPcniLHVM:2a8v9k3JdbPcIidbPcIG
                                                                                                                                                                                                                                                MD5:61E4CB2AAD66285E9113071057F39C35
                                                                                                                                                                                                                                                SHA1:A2BD21090859669C4B6A875E077825381B7E2702
                                                                                                                                                                                                                                                SHA-256:9E96C7123100234A7018533764502985A208F2EB3314F5B6332D46016725A63F
                                                                                                                                                                                                                                                SHA-512:589A2D65508B07B5FDEDA883F71A4B496B25458CA1ECE7C4D4F5DAE82EB683DA82C8E21E57D63A235AB600174C9D362A746B2E27BAA6E3ADE1B7BD9D6000BE27
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \.. "\u0c06\u0c26\u0c3f"\.. "\u0c38\u0c4b\u0c2e"\.. "\u0c2e\u0c02\u0c17\u0c33"\.. "\u0c2c\u0c41\u0c27"\.. "\u0c17\u0c41\u0c30\u0c41"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\.. "\u0c36\u0c28\u0c3f"].. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \.. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"].. ::msgcat::mcset te MONTHS_ABBREV [list \.. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\.. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\.. "\u0c2e\u0c3

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\te_in.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):419
                                                                                                                                                                                                                                                Entropy (8bit):5.058324650031252
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:4EnLB383LjZWsn0sHjoD0savzda3v6ry/ZF3vMSVn:4aR833Z1nnHjoDnavzd8vSCZNvMSV
                                                                                                                                                                                                                                                MD5:BCA040A356E7E8CC597EFB9B9065F8E1
                                                                                                                                                                                                                                                SHA1:ADAF7EC8C2035BC06E168D3F1BD7F39277E9273F
                                                                                                                                                                                                                                                SHA-256:B110FEEDDA21ECCEFA624BEF8E1476E9F221FB253880AC370967AE4D0237CA7A
                                                                                                                                                                                                                                                SHA-512:D408ECE8CF89FB23B45420D3CBA7655EEE713498210889A84EE25D3417360705546D97028EAAAA47764B6E9B0A3699669B98C0A53861A38E0DFCB9F3B8A47BEC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\th.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2359
                                                                                                                                                                                                                                                Entropy (8bit):4.382796122808316
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:439X4QKPQJecQwFA0P9JmDsxQ7KHfWkD2CQM0DnWxFDzCYmdrtVP:29ohCi1028QmHfIC4jW3DmHB
                                                                                                                                                                                                                                                MD5:7F61E1EA256D78948189EF07119663CD
                                                                                                                                                                                                                                                SHA1:6867E9780049FACE9984B7788B6F362B8D1AD718
                                                                                                                                                                                                                                                SHA-256:48BEAF693BF5B6EED15234DB0D375B97E6D576A749E9048420C153E6CAFC0259
                                                                                                                                                                                                                                                SHA-512:F3E24E0B41A7D722AC2FA0E429A2DCB1CCB5BAECC9912ADF6AF79C51366EA1AC9F931F0F44F068F3CEE6873516E6223CC5E7616CF523B1DFB9E528DE4D58454A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \.. "\u0e2d\u0e32."\.. "\u0e08."\.. "\u0e2d."\.. "\u0e1e."\.. "\u0e1e\u0e24."\.. "\u0e28."\.. "\u0e2a."].. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \.. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\.. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"].. ::msgcat::mcset th MONTHS_ABBREV [list \.. "\u0e21.\u0e04."\.. "\u0e01.\u0e1e."\.. "\u0e21\u0e35.\u0e04."\.. "\u0e40\u0e21.\u0e22."\.. "\u0e1e.\u0e04."\.. "\u0e21\u0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\tr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1183
                                                                                                                                                                                                                                                Entropy (8bit):4.390397293529625
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR83ZVUflVdq4qTr6dyX59508THHCh5LbQgWiNv9KvWIn:43PXTtbTngLhWiJGWIn
                                                                                                                                                                                                                                                MD5:017F0F989BD5DBBF25E7C797CE09C45C
                                                                                                                                                                                                                                                SHA1:162922DBD55A31A74410375A36EE7BC50E092BDD
                                                                                                                                                                                                                                                SHA-256:4B85B345D6C43F7257C6849A60A492397FD5FD9D82DF3A2252189D7A1ECCBB64
                                                                                                                                                                                                                                                SHA-512:73B6CF395753D863330687404E8A584CB08B81A8CC456DCE7BB49C4EA15EA19E45E3CC1E1367E10915DE14AC6258383289BCFEF55AD2768A50889DF390D37EF9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \.. "Paz"\.. "Pzt"\.. "Sal"\.. "\u00c7ar"\.. "Per"\.. "Cum"\.. "Cmt"].. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \.. "Pazar"\.. "Pazartesi"\.. "Sal\u0131"\.. "\u00c7ar\u015famba"\.. "Per\u015fembe"\.. "Cuma"\.. "Cumartesi"].. ::msgcat::mcset tr MONTHS_ABBREV [list \.. "Oca"\.. "\u015eub"\.. "Mar"\.. "Nis"\.. "May"\.. "Haz"\.. "Tem"\.. "A\u011fu"\.. "Eyl"\.. "Eki"\.. "Kas"\.. "Ara"\.. ""].. ::msgcat::mcset tr MONTHS_FULL [list \.. "Ocak"\.. "\u015eubat"\.. "Mart"\.. "Nisan"\.. "May\u0131s"\.. "Haziran"\.. "Temmuz"\.. "A\u011fustos"\.. "Eyl\u00fcl"\.. "Ekim"\.. "Kas\u0131m"\.. "Aral\u

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\uk.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2165
                                                                                                                                                                                                                                                Entropy (8bit):4.289021158621493
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:436yILgoQjQPxUIkgPDRQnQ0vVQbC1iQwweIgWQDIoZI7QDI3QbI87IVQnIzQ7mh:2AzUe3EhV8CYgrbH7z3fLVTzgn5jyX7p
                                                                                                                                                                                                                                                MD5:323BD95809A44B0BADC71AD36E5F095B
                                                                                                                                                                                                                                                SHA1:44F6016873CA955D27545C56CCD24BDB06A83C43
                                                                                                                                                                                                                                                SHA-256:7093DA7E39CEB6D3F51EB6CF1CCA2D7F3680ED7B8FE4A5F0CECEEF6BEB21AC77
                                                                                                                                                                                                                                                SHA-512:DB16E0E2D17CE47673DE781A7171944C14CC550FB8EB0920C05B979E4D067E36DF0B59B8BFA81F82D8FCE1FFDDAAD2755E68BFE5BC0DBB11E8716A4D18BA5F7E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0432\u0442"\.. "\u0441\u0440"\.. "\u0447\u0442"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0456\u043b\u044f"\.. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\.. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\.. "\u0441\u0435\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440"\.. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset uk MONTHS_ABBREV [list \.. "\u0441\u0456\u0447"\.. "\u043b\u044e\u0442"\.. "\u0431\u0435\u0440"\.. "\u043a\u0432\u0456\u0442"\.. "\u0442\u0440\u0430\u0432"\.. "\u0447\u0435\u0440\u0432"\.. "\u043b

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\vi.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1471
                                                                                                                                                                                                                                                Entropy (8bit):4.44729506678271
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:4aR836DNjYTP55YAUy2tJ9kyzW68IFYHMBSW1K1pvhv1O:43dbYJyC8ySgI1dV1O
                                                                                                                                                                                                                                                MD5:C127F54C462917D3B3EEF5F29F612138
                                                                                                                                                                                                                                                SHA1:B1D9A67F856D93F98524C6372B352EA0DE1B9CD3
                                                                                                                                                                                                                                                SHA-256:E9B7AECD456F1D2288604C982B5DED0DCF71DCA968C0B0EAFF4CA16CC3B73EC2
                                                                                                                                                                                                                                                SHA-512:0B0F132F10580751258D37E070338C3B39DF57FDECDB9D0AFA67E90D6766DDCB4D711876E551ED759D177F1B8F4E9E1DD8F7899F7CB57F8039F55EC4C2984E87
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \.. "Th 2"\.. "Th 3"\.. "Th 4"\.. "Th 5"\.. "Th 6"\.. "Th 7"\.. "CN"].. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \.. "Th\u01b0\u0301 hai"\.. "Th\u01b0\u0301 ba"\.. "Th\u01b0\u0301 t\u01b0"\.. "Th\u01b0\u0301 n\u0103m"\.. "Th\u01b0\u0301 s\u00e1u"\.. "Th\u01b0\u0301 ba\u0309y"\.. "Chu\u0309 nh\u00e2\u0323t"].. ::msgcat::mcset vi MONTHS_ABBREV [list \.. "Thg 1"\.. "Thg 2"\.. "Thg 3"\.. "Thg 4"\.. "Thg 5"\.. "Thg 6"\.. "Thg 7"\.. "Thg 8"\.. "Thg 9"\.. "Thg 10"\.. "Thg 11"\.. "Thg 12"\.. ""].. ::msgcat::mcset vi MONTHS_FULL [list \.. "Th\u00e1ng m\u00f4\u0323t"\.. "Th\u00e1ng hai"\.. "Th\u00e1ng ba"\.. "Th\u00e1ng t\u01b0"\.. "Th\u00e

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\zh.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1598), with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3385
                                                                                                                                                                                                                                                Entropy (8bit):4.5164095151631125
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:43qrY2BBT7uxDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyke2gdr:2yPTKdo
                                                                                                                                                                                                                                                MD5:2F356DE14D48B1091DEAA32D20C38D96
                                                                                                                                                                                                                                                SHA1:4AB78D47A73290000955A7C1DFDF7106093F69FD
                                                                                                                                                                                                                                                SHA-256:EB247F5184A59414D3DF7E3ECA51F5998C248CFB27D2C02E62A7A30AB35197A7
                                                                                                                                                                                                                                                SHA-512:602410830018B455C68AE2EBDD83BA561CF59DA5898E00C80CE7EF619912E591EB38B4C8FE8D9B1F024E7105B0C4D2D326FC855F31E79C1B954429B947DFFBB1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh MONTHS_ABBREV [list \.. "\u4e00\u6708"\.. "\u4e8c\u6708"\.. "\u4e09\u6708"\.. "\u56db\u6708"\.. "\u4e94\u6708"\.. "\u516d\u6708"\.. "\u4e03\u6708"\.. "\u516b\u6708"\.. "\u4e5d\u6708"\.. "\u5341\u6708"\.. "\u5341\u4e00\u6708"\.. "\u5341\u4e8c\u6708"\.. ""].. ::msgcat::m

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\zh_cn.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):319
                                                                                                                                                                                                                                                Entropy (8bit):5.167825099880243
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoX5YBoHJ+3vtfNrsoHJ+3v6MYBoXa+3vYq9vn:4EnLB383U5YMJ+3vtN3J+3v6LcL3vYqN
                                                                                                                                                                                                                                                MD5:9FCDC2E80E13984D434E3CC91E1ED14C
                                                                                                                                                                                                                                                SHA1:710D9EE2A71021F4AB609886138EED43C1380ACD
                                                                                                                                                                                                                                                SHA-256:4C8A855700FEFE8EE21B08030FF4159D8011AE50353F063229C42DE6292475CF
                                                                                                                                                                                                                                                SHA-512:D899A1F58DF1051BB2C2C4AC859C52A2D19B1593C37022A29439B37A8057ADC3941F3564E2E1D9CEB72AE123A4E12E24C3736343AA3A5EC8749AB5AEBBF65085
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e".. ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2".. ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\zh_hk.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):780
                                                                                                                                                                                                                                                Entropy (8bit):4.716025632367214
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:4EnLB383HmSBBHZovDh4ToC4qU3WwVW3v6P3v3WwSn:4aR83Hxo14u3Ww+viv3WwS
                                                                                                                                                                                                                                                MD5:CFDA7B6463305FA15DBBA72D725A1876
                                                                                                                                                                                                                                                SHA1:2BF885073FBAF4A38B7AFDA76CA391F195A5A362
                                                                                                                                                                                                                                                SHA-256:7E1C5BD9EC1A17BB851B0DCABD0DFA9FF9D64B89603D9D3FBEAAC609172346AE
                                                                                                                                                                                                                                                SHA-512:55F974C706933ECE0575A33C381D9B370B8A408C5C5514C805EC04C8B0CA5BAFAA47267DA98E1805B478A9589FFB7549D79002B2A7AF387049011D78DD7605B6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u4e00"\.. "\u4e8c"\.. "\u4e09"\.. "\u56db"\.. "\u4e94"\.. "\u516d"].. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"\.. ""].. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5".. ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S".. ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\zh_sg.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):347
                                                                                                                                                                                                                                                Entropy (8bit):5.062880051437783
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoOpEoPpFocMohX3v6Zwoh+3v6fxvn:4EnLB383J53v6O3vCn
                                                                                                                                                                                                                                                MD5:3218F8E6BEDD534277DE0849C423158E
                                                                                                                                                                                                                                                SHA1:10C006446A10406A5644C4033665E877EBF72AF7
                                                                                                                                                                                                                                                SHA-256:500546B3211D454659D845B4AB9AEF226125100DF40407C49530DE17CDD4363F
                                                                                                                                                                                                                                                SHA-512:3142893DA85BA8F83A5B6851B313B5F5FF80D2B989C1AE015665EE70373249B44EFB4FF7C621F1D8F37AC6019EF5E8D6D21C76C48998C3D9072F9C5060AA8813
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_SG AM "\u4e0a\u5348".. ::msgcat::mcset zh_SG PM "\u4e2d\u5348".. ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y".. ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\msgs\zh_tw.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):354
                                                                                                                                                                                                                                                Entropy (8bit):5.124064818715749
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSyEtJLl73oo6d3/xoAykaRULH/XRxy/5oAyjZRULHi5oAyU/G0OMoAyxW3v6ZQ:4EnLB38315xDOiKRRW3v6F3v8A2n
                                                                                                                                                                                                                                                MD5:9010E34791B5DDB7F1E0AD4DA6BD4623
                                                                                                                                                                                                                                                SHA1:418F7374BABEF27FEC8E00D3A32F535084593AB9
                                                                                                                                                                                                                                                SHA-256:DBA0584B8E1925B439F06E0BF0965E97AFB7EB39E70E0E4C9B70769EBC5F996C
                                                                                                                                                                                                                                                SHA-512:D3AB698B725E84DAB06E472C41FF2EB55D63885D22B4598C596800BAC83A02A44CB524524F267D090952AF7E0031F47720786ACF9E354EF672CF9EEFB7DB3BD4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d".. ::msgcat::mcset zh_TW CE "\u6c11\u570b".. ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e".. ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z"..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\opt0.4\optparse.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):33777
                                                                                                                                                                                                                                                Entropy (8bit):4.60013086740989
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:4D0xrpIuhenN4kA0G6sRcl5AdtsPLKiF64aJQ2L:HpnhsS9C5Adqua5aJvL
                                                                                                                                                                                                                                                MD5:4ECD97188BFED58A15FE22EC566FA6A3
                                                                                                                                                                                                                                                SHA1:6E4E91096298F1A0AE6CD4241F167C8B4F661EE5
                                                                                                                                                                                                                                                SHA-256:67A157F1873D606B53DC4D894BD8E71F6B1A0DD66177B9513BD039B348B40349
                                                                                                                                                                                                                                                SHA-512:1D5067BBB13DAB001168EEB41EBFA2D13BACB0F43A8067CC93923E8F4D062AA387DA23D7D98D6A2AE77D7C849A6026F2343102CBE03690C2CEA0890222339475
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# optparse.tcl --..#..# (private) Option parsing package..# Primarily used internally by the safe:: code...#..#.WARNING: This code will go away in a future release..#.of Tcl. It is NOT supported and you should not rely..#.on it. If your code does rely on this package you..#.may directly incorporate this code into your application.....package require Tcl 8.5-..# When this version number changes, update the pkgIndex.tcl file..# and the install directory in the Makefiles...package provide opt 0.4.8....namespace eval ::tcl {.... # Exported APIs.. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \.. OptProc OptProcArgGiven OptParse \... Lempty Lget \.. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \.. SetMax SetMin......################# Example of use / 'user documentation' ###################.... proc OptCreateTestProc {} {.....# Defines ::tcl::OptParseTest as a test proc with parsed arguments...# (can't be d

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\opt0.4\pkgIndex.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):620
                                                                                                                                                                                                                                                Entropy (8bit):4.702477618616754
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:jHxIRu9zhjJS42wbGlTULuUAZb3KykszLYIGbyAkXaqrQ+pBb6:biRUJS42wbGlTUcZ+yk2LY0XaqrB4
                                                                                                                                                                                                                                                MD5:07532085501876DCC6882567E014944C
                                                                                                                                                                                                                                                SHA1:6BC7A122429373EB8F039B413AD81C408A96CB80
                                                                                                                                                                                                                                                SHA-256:6A4ABD2C519A745325C26FB23BE7BBF95252D653A24806EB37FD4AA6A6479AFE
                                                                                                                                                                                                                                                SHA-512:0D604E862F3A1A19833EAD99AAF15A9F142178029AB64C71D193CEE4901A0196C1EEDDC2BCE715B7FA958AC45C194E63C77A71E4BE4F9AEDFD5B44CF2A726E76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Tcl package index file, version 1.1..# This file is generated by the "pkg_mkIndex -direct" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....if {![package vsatisfies [package provide Tcl] 8.5-]} {return}..package ifneeded opt 0.4.8 [list source [file join $dir optparse.tcl]]..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\package.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):23995
                                                                                                                                                                                                                                                Entropy (8bit):4.884828325514459
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
                                                                                                                                                                                                                                                MD5:DDB0AB9842B64114138A8C83C4322027
                                                                                                                                                                                                                                                SHA1:ECCACDC2CCD86A452B21F3CF0933FD41125DE790
                                                                                                                                                                                                                                                SHA-256:F46AB61CDEBE3AA45FA7E61A48930D64A0D0E7E94D04D6BF244F48C36CAFE948
                                                                                                                                                                                                                                                SHA-512:C0CF718258B4D59675C088551060B34CE2BC8638958722583AC2313DC354223BFEF793B02F1316E522A14C7BA9BED219531D505DE94DC3C417FC99D216A01463
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# package.tcl --..#..# utility procs formerly in init.tcl which can be loaded on demand..# for package management...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval tcl::Pkg {}....# ::tcl::Pkg::CompareExtension --..#..# Used internally by pkg_mkIndex to compare the extension of a file to a given..# extension. On Windows, it uses a case-insensitive comparison because the..# file system can be file insensitive...#..# Arguments:..# fileName.name of a file whose extension is compared..# ext..(optional) The extension to compare against; you must..#..provide the starting dot...#..Defaults to [info sharedlibextension]..#..# Results:..# Returns 1 if the extension matches, 0 otherwise....proc tcl::Pkg::CompareExtension {fileName {ext {}}} {.. global tcl_platfor

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\parray.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):844
                                                                                                                                                                                                                                                Entropy (8bit):4.883013702569192
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:TF7S2n2wn2SNHaeYF9xcwrmXhbs1GUiSYX3EtSK78ex4VIpynEw88/McUBbPgnz:TF7Hn2wnlk2KwyZSM4SkV/3UB7Cz
                                                                                                                                                                                                                                                MD5:577787C2F4F5956BA70F83012B980AE5
                                                                                                                                                                                                                                                SHA1:040B2469F796F3FDFCD1E1DD2EB1C5B799EDEF62
                                                                                                                                                                                                                                                SHA-256:E269029C8263E3CBC1920C3604ECDCF15EDCCB208A0D68F9EB42B73954D620C0
                                                                                                                                                                                                                                                SHA-512:C2940F6F3D77412EFC537B8AB67352F519DFFA95739FCC17BF1817335AFD9E5BFE91ABE98CBA99E278CB4923D4E6D431ED9D72282745203C0F7D73193F550238
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# parray:..# Print the contents of a global array on stdout...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....proc parray {a {pattern *}} {.. upvar 1 $a array.. if {![array exists array]} {...return -code error "\"$a\" isn't an array".. }.. set maxl 0.. set names [lsort [array names array $pattern]].. foreach name $names {...if {[string length $name] > $maxl} {... set maxl [string length $name]...}.. }.. set maxl [expr {$maxl + [string length $a] + 2}].. foreach name $names {...set nameString [format %s(%s) $a $name]...puts stdout [format "%-*s = %s" $maxl $nameString $array($name)].. }..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\safe.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):42223
                                                                                                                                                                                                                                                Entropy (8bit):4.822635446297551
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:H/Jo8y7AyARYhZfc3njlVdRIp4xOtoYx4WneNiBq5vIhfwEaqadlUCJ2Pbb1P6:H/c7AmhZmnjvdRIG924WneNiBq5+fwEc
                                                                                                                                                                                                                                                MD5:B8C1561D471CFBF4111C706411D59883
                                                                                                                                                                                                                                                SHA1:71483EAEEF377EE9AF90BEC44F70C7B12C5BC720
                                                                                                                                                                                                                                                SHA-256:C21DCE3AB31893118BBED01E559070F1D3541877FEE331BD45F5BF4300ED9654
                                                                                                                                                                                                                                                SHA-512:465065A938C71AF4588B3331B51A62DD57F57492EB1CB6C0F52B9FD0A2FE7A54B1E995AA56E4A41D7A99EAFF665C1E23E3B240FB3F9840AB242C21B1DBFFFF45
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# safe.tcl --..#..# This file provide a safe loading/sourcing mechanism for safe interpreters...# It implements a virtual path mechanism to hide the real pathnames from the..# child. It runs in a parent interpreter and sets up data structure and..# aliases that will be invoked when used from a child interpreter...#..# See the safe.n man page for details...#..# Copyright (c) 1996-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....#..# The implementation is based on namespaces. These naming conventions are..# followed:..# Private procs starts with uppercase...# Public procs are exported and starts with lowercase..#....# Needed utilities package..package require opt 0.4.8....# Create the safe namespace..namespace eval ::safe {.. # Exported API:.. namespace export interpCreate interpInit interpConfigure interpDelete \...interpAddToAccessPath interpFindInAccessPath setL

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tclIndex

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5617
                                                                                                                                                                                                                                                Entropy (8bit):4.747404679682368
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
                                                                                                                                                                                                                                                MD5:C62FB22F4C9A3EFF286C18421397AAF4
                                                                                                                                                                                                                                                SHA1:4A49B8768CFF68F2EFFAF21264343B7C632A51B2
                                                                                                                                                                                                                                                SHA-256:DDF7E42DEF37888AD0A564AA4F8CA95F4EEC942CEBEBFCA851D35515104D5C89
                                                                                                                                                                                                                                                SHA-512:558D401CB6AF8CE3641AF55CAEBC9C5005AB843EE84F60C6D55AFBBC7F7129DA9C58C2F55C887C3159107546FA6BC13FFC4CCA63EA8841D7160B8AA99161A185
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Tcl autoload index file, version 2.0..# -*- tcl -*-..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(auto_reset) [list source [file join $dir auto.tcl]]..set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.t

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tm.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12204
                                                                                                                                                                                                                                                Entropy (8bit):4.763796758810551
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
                                                                                                                                                                                                                                                MD5:215262A286E7F0A14F22DB1AA7875F05
                                                                                                                                                                                                                                                SHA1:66B942BA6D3120EF8D5840FCDEB06242A47491FF
                                                                                                                                                                                                                                                SHA-256:4B7ED9FD2363D6876092DB3F720CBDDF97E72B86B519403539BA96E1C815ED8F
                                                                                                                                                                                                                                                SHA-512:6ECD745D7DA9D826240C0AB59023C703C94B158AE48C1410FAA961A8EDB512976A4F15AE8DEF099B58719ADF0D2A9C37E6F29F54D39C1AB7EE81FA333A60F39B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# -*- tcl -*-..#..# Searching for Tcl Modules. Defines a procedure, declares it as the primary..# command for finding packages, however also uses the former 'package unknown'..# command as a fallback...#..# Locates all possible packages in a directory via a less restricted glob. The..# targeted directory is derived from the name of the requested package, i.e...# the TM scan will look only at directories which can contain the requested..# package. It will register all packages it found in the directory so that..# future requests have a higher chance of being fulfilled by the ifneeded..# database without having to come to us again...#..# We do not remember where we have been and simply rescan targeted directories..# when invoked again. The reasoning is this:..#..# - The only way we get back to the same directory is if someone is trying to..# [package require] something that wasn't there on the first scan...#..# Either..# 1) It is there now: If we rescan, you get it; if not you don

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Abidjan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):147
                                                                                                                                                                                                                                                Entropy (8bit):4.995501022397479
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2DcsBdNMXGm2OHnFvpsYoHsdSalHFLwy:SlSWB9eg/2DBpDm2OHnFvmYoH1alHOy
                                                                                                                                                                                                                                                MD5:FF8B5540631A6EE93507338C4E7AA49D
                                                                                                                                                                                                                                                SHA1:817B261A1B6B92AA498EC286349964EA10FB5A84
                                                                                                                                                                                                                                                SHA-256:7213997BB9CF9D384A7002B8C8EFEF25C01ABA6083D9835A16D583D5DCEE40A0
                                                                                                                                                                                                                                                SHA-512:8D78AC4868ED0013EDA536C0E82E0E91398772AA18C637AEFE22F24B142FCDA55A4CB853B2282951E907C9E2F62BD3F831A5CF995F52898F5225D16889943A9C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Abidjan) {.. {-9223372036854775808 -968 0 LMT}.. {-1830383032 0 0 GMT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Accra

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.832432925672155
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dc9XfBQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DUGDBS
                                                                                                                                                                                                                                                MD5:52FDFD3DB98475FBBB620D0D5565C5CC
                                                                                                                                                                                                                                                SHA1:C7750452859663605272553DBEE0B6C134E1517C
                                                                                                                                                                                                                                                SHA-256:6040827AFED8CEF45F252FBD7E3E862C0B5E9D06C1C98C58BAD61DFE67BD57CC
                                                                                                                                                                                                                                                SHA-512:2FF9D96D81279148A86BE208FEEACCBCB8B4224D093D6C092ECD1C4EA2186589CCF947027D3A726600C703611B4CFEE029AA14ED3E8593C477B427C4F342CF27
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Accra) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Addis_Ababa

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.817170256300069
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DczqIVDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DnaDkO
                                                                                                                                                                                                                                                MD5:30CDD4D37E9DD60FBF6D754C9343F364
                                                                                                                                                                                                                                                SHA1:56F896C21068764B7B8F884F374B18913CA3D9CA
                                                                                                                                                                                                                                                SHA-256:E11FD8AD8572B684333810CFDC23B92E1ACF619875866985E288D92F8277D07F
                                                                                                                                                                                                                                                SHA-512:78FC8043CCE25713404E70996229E5EA8238BF5C0F59029064EDA5494E2D4F54398931F3D855E30C82B2C53B789C40EE4CBF09D0F98C2BA6734595D4AA75017A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Algiers

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1080
                                                                                                                                                                                                                                                Entropy (8bit):4.187497782275587
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862D7nmdHh5Cv6/lHY8SOSuvvzXipFSgSO5vW5aKmvbsF6VWsXN87QBWcAFy:5veSvKlHYXNujXipFSjKRKXiWsXCGWJy
                                                                                                                                                                                                                                                MD5:E8D3DF11CE0E7575485573FA07D955D5
                                                                                                                                                                                                                                                SHA1:3B2C00C85B6C0BFAA1C676C970D6DF1B4BDC3D4A
                                                                                                                                                                                                                                                SHA-256:E6874647561CE1C5FD1F650C9B167F77AC5B24FD2026046399A9043CF998E5C4
                                                                                                                                                                                                                                                SHA-512:E2968BE847622CF243C0E498436FD21BDC2E1DF0FD8D694F2C70569D17CE896CDE4968BB8ABDEF9F687439E4EA2D955AE87D6C15E81F881EE1413416A90765D4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Algiers) {.. {-9223372036854775808 732 0 LMT}.. {-2486592732 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1531443600 0 0 WET}.. {-956365200 3600 1 WEST}.. {-950486400 0 0 WET}.. {-942012000 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796262400 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766630800 3600 0 CET}.. {-733280400 0 0 WET}.. {-439430400 3600 0 CET}.. {-212029200 0 0 WET}.. {41468400 3600 1 WEST}.. {54774000 0 0 WET}.. {231724800 3600 1 WEST}.. {246240000 3600 0 CET}.. {259545600 7200 1 CEST}.. {275274000 3600 0 CET}.. {309740400 0 0 WET}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Asmara

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.801054282631739
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjEUEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DGs+DR
                                                                                                                                                                                                                                                MD5:A543BDEB3771017421FB75231F0004F2
                                                                                                                                                                                                                                                SHA1:D682C58C27562FF3ABAB8EDE8EB6EA754DA7C02E
                                                                                                                                                                                                                                                SHA-256:064EB7F9A1FA05A317C6BDCA6B102BC1560D980758F9E4DDB010C9E7DC068ECB
                                                                                                                                                                                                                                                SHA-512:44848D60EDC79AF784A819714C0D9F62DCCB6329B47F25D74AB8C174BF9EC3F783C66FEB27F588A93FABA9BECAF076F453D6D797CE4F28461F7AE69440EA54C7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Asmera

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.806258322241929
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjAWDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2D8DkOn
                                                                                                                                                                                                                                                MD5:1B5E386E7A2F10D9385DE4C5683EBB85
                                                                                                                                                                                                                                                SHA1:FECBA599C37493D2E0AEE8E21BAB40BF8E8DC82A
                                                                                                                                                                                                                                                SHA-256:76939852A98EA7BF156D0AC18B434CC610DAF5232322C0FBB066CD52C5B72AF7
                                                                                                                                                                                                                                                SHA-512:B36FABFCDB2187A3A4A211C8E033D96C91E3C4D47907D284E10786555562C82231566033EAB4753EF1E48DF1233CFC8C6C0FB3CA50748BE0B2554A972A88FBA0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Bamako

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.883634030944169
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcxAQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwNDBS
                                                                                                                                                                                                                                                MD5:6B9BB5B37C41AA727E31BF03483DC1CA
                                                                                                                                                                                                                                                SHA1:CB3BBA37B063EA4A54CD15C6E30C14D8CA30D3C0
                                                                                                                                                                                                                                                SHA-256:F6D1BA22115A6565B6D6ABEB578F001DDB41E673C422C8EA70D0DF77B24115F6
                                                                                                                                                                                                                                                SHA-512:23DB3E298FDEB165FD85D99E03C00835B584984B814AF7F54A9CDD4A9F93E16B0C58342D319129F46CF8EC36F93DE5EA51B492CA4CABDAB75D84709BC6C26119
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Bangui

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.882974805254803
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcx2m/2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dw/2D4yn
                                                                                                                                                                                                                                                MD5:92FF9E5835C0C80F358BFE69120660A0
                                                                                                                                                                                                                                                SHA1:724758B43BD79DD8A29B02BE6910D492924F8280
                                                                                                                                                                                                                                                SHA-256:5047A507D22B68C9349EB6A48C41C80DB4C69F98F99C6574059DEA87178E36C0
                                                                                                                                                                                                                                                SHA-512:6FCB709DB4AC19191FECE1E8BAC55E77F265B5AF89F7A3565F06BFAF0BEE12E3EAF2F52CA09C68D75C358C25A31867505CE8AD75D7386DCD15F4BE1CE61272CD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Bangui) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Banjul

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.888193386512119
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcx79FHp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dw7J4c
                                                                                                                                                                                                                                                MD5:46E5703CF284E44E15E5872DF075FCBC
                                                                                                                                                                                                                                                SHA1:EA4BFA6D568DFA877F72302ADA21ECC2840D9FD5
                                                                                                                                                                                                                                                SHA-256:77E610A02CCECE3045B09D07A9BE6100F5AA9C3C2AEB543535C9AE941194F4E4
                                                                                                                                                                                                                                                SHA-512:1454467FE63E97DFA4DE66E359F68B2D80C92CDE59FC15A4BE513629FFD154D2281EADF3FC78F7AFDDF5A5896195F3A69E66697A659BBB1A0EAFD3E1DA6565EC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Bissau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.847843768169462
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2Dc5iDMXGm2OHGVkeoHsdSawwF6hSVPVFwy:SlSWB9eg/2D4uDm2OHCkeoH1awwFMmMy
                                                                                                                                                                                                                                                MD5:7E710C939B9CC0C1AC1ECF4239B543C5
                                                                                                                                                                                                                                                SHA1:429CC87086FB22727815ED05AC6472333FF06013
                                                                                                                                                                                                                                                SHA-256:2A870E534DE67713C27F2F3B9BF26FA7498C240CF633988CE76DBDAC5B69214D
                                                                                                                                                                                                                                                SHA-512:70D9365C31C43A95211FC20E9290B24D356FFEFA935B8829CE32831026A196DECDD12226097F6DA3B4B919E137AA0181714680CDBB72B00C130A87E3A4735004
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Bissau) {.. {-9223372036854775808 -3740 0 LMT}.. {-1830380400 -3600 0 -01}.. {157770000 0 0 GMT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Blantyre

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.904342145830274
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc8ycXp75h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAmp1hs
                                                                                                                                                                                                                                                MD5:7AD3749D7047855CB9B9EC9696015402
                                                                                                                                                                                                                                                SHA1:F792359AD9EEC2ABD98DAFA6661C1E57BAB89EBE
                                                                                                                                                                                                                                                SHA-256:8F700409B8EEE33ACE5F050414971FFEE0270949842E58E9299BB5CD6CCF34DE
                                                                                                                                                                                                                                                SHA-512:681C1B318746C587DEBA6E109D1D5A99D1F3E28FE46C24F36B69D533D884FDDC6EA35BB31A475575D683B73BF129FED761523EC9285F2FF1E4CACA2C54C046C5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Brazzaville

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.901235831565769
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DciE0TMJZp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D4qGp4D1
                                                                                                                                                                                                                                                MD5:7028268EE88250AC40547A3FDBBFC67C
                                                                                                                                                                                                                                                SHA1:5006D499CD1D1CB93EB3DA0EC279F76B7123DAA6
                                                                                                                                                                                                                                                SHA-256:596DB2D64CDD6250642CB65514D5BCB52F3E3EA83F50D8915D9D4FDEA008F440
                                                                                                                                                                                                                                                SHA-512:D623C69FE8A6050E77FB819C2F5FAEE35D5034182B1D30A409C17208155501656133E774E402875537335F8201E4734A0B5D327712CBF623AC330F1014D9025B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Bujumbura

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.947752840781864
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DclbDcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkbDEi
                                                                                                                                                                                                                                                MD5:0EBC2D8F0BD1A32C21070F9397EAC9E2
                                                                                                                                                                                                                                                SHA1:95AAA97427265635784E8AC624CA863DB9F1475D
                                                                                                                                                                                                                                                SHA-256:9A15867255B43A954CA60DA11660F157553AAB6A15C50ACD49D182276E0CF4CC
                                                                                                                                                                                                                                                SHA-512:4CD2E14F84C58E955742637A51D99DB9493972671A2B5D801EBD9D901D4903654E374C59BF010C70071D33FA17788358F78004201A787CCA2AD714D670393488
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Cairo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3852
                                                                                                                                                                                                                                                Entropy (8bit):3.7766651198444507
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:58ybRwEa40MF4pt0/jaGYbaJF0a3T07ITB85oWXmSGmuyTVuV0apRQnL0KD3rZza:fLg1GbJFp3gHRQVy7DPUUQkiHMo
                                                                                                                                                                                                                                                MD5:9DCDB3DD41DA13D81EB8E1CAF56964DA
                                                                                                                                                                                                                                                SHA1:F95EE7B1EF464F2640EC4AE29F3C18B5BF2B2905
                                                                                                                                                                                                                                                SHA-256:8698B0A53D858AEA7C495EDF759EF0E6C63F7E07A256599393DEC7B7A7413734
                                                                                                                                                                                                                                                SHA-512:BA5898ABEE541BC72C9DEDD77BABB18024C7AEA0274FA3F809748FCBFF770BFAD902BF70680DDE989F7D3592E5398C100D0E0EA388D4200911ED7DE089535D6D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Cairo) {.. {-9223372036854775808 7509 0 LMT}.. {-2185409109 7200 0 EET}.. {-929844000 10800 1 EEST}.. {-923108400 7200 0 EET}.. {-906170400 10800 1 EEST}.. {-892868400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-857790000 7200 0 EET}.. {-844308000 10800 1 EEST}.. {-825822000 7200 0 EET}.. {-812685600 10800 1 EEST}.. {-794199600 7200 0 EET}.. {-779853600 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165801600 7200 0 EET}.. {-147402000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Casablanca

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5532
                                                                                                                                                                                                                                                Entropy (8bit):3.535398586134154
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:zE+CJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:7MZSszBrlKcJC9k
                                                                                                                                                                                                                                                MD5:18183122D242E0B69A80BC02BC0328DF
                                                                                                                                                                                                                                                SHA1:C9976ABC0663EB29A2FEAAFDF6746C05A264B67C
                                                                                                                                                                                                                                                SHA-256:8776EEDFDFEE09C4C833593127CEFAC9C33E2487AB9BF4BF8C73E5E11B4E5613
                                                                                                                                                                                                                                                SHA-512:9611A6EF9C5B55FAB752C1EC7E464B8AF60AE32383CE9BA72F35168ABB68A45DB0654A9099CBDC123F5F6E2B6DB7C8FBF56A8DDB813824187AD1090971F12219
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Casablanca) {.. {-9223372036854775808 -1820 0 LMT}.. {-1773012580 0 0 +00}.. {-956361600 3600 1 +00}.. {-950490000 0 0 +00}.. {-942019200 3600 1 +00}.. {-761187600 0 0 +00}.. {-617241600 3600 1 +00}.. {-605149200 0 0 +00}.. {-81432000 3600 1 +00}.. {-71110800 0 0 +00}.. {141264000 3600 1 +00}.. {147222000 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {448243200 3600 0 +01}.. {504918000 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {13731

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Ceuta

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7536
                                                                                                                                                                                                                                                Entropy (8bit):3.8315604186920704
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:TzLdXKy9f4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:TdayR41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:30155093248C4F7E45EF7C0132D2B2AB
                                                                                                                                                                                                                                                SHA1:FAD100CC49F0CB0910BDE39B43295A47512E1BE6
                                                                                                                                                                                                                                                SHA-256:8827F7311EDE69A9679BDF2B7418DBF350A2FC8F973E8B1E1E4390D4D5C6D2E8
                                                                                                                                                                                                                                                SHA-512:469A24AF0C2A4A40CB2488C3E21BB9BBDE057F876EACA08A31FC6F22845063D917A0A4AE96680401E45792DE534EE3A305F137A93C4DF879B4602510D881270E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ceuta) {.. {-9223372036854775808 -1276 0 LMT}.. {-2177452800 0 0 WET}.. {-1630112400 3600 1 WEST}.. {-1616810400 0 0 WET}.. {-1451692800 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1293840000 0 0 WET}.. {-94694400 0 0 WET}.. {-81432000 3600 1 WEST}.. {-71110800 0 0 WET}.. {141264000 3600 1 WEST}.. {147222000 0 0 WET}.. {199756800 3600 1 WEST}.. {207702000 0 0 WET}.. {231292800 3600 1 WEST}.. {244249200 0 0 WET}.. {265507200 3600 1 WEST}.. {271033200 0 0 WET}.. {448243200 3600 0 CET}.. {504918000 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Conakry

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.88110192592456
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcmMM1+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DCM1+c
                                                                                                                                                                                                                                                MD5:8CDD2EEB7E0EC816F3EC051350FEBF13
                                                                                                                                                                                                                                                SHA1:37F3A149B4A01DFA2EAB42A28C810BE66AAB7C52
                                                                                                                                                                                                                                                SHA-256:3176C99FC45337CBCE0CD516DE4B02B8BAA47D00E84F698122A2ADD57797984E
                                                                                                                                                                                                                                                SHA-512:5A90B6DB45EDAD7734D596FB81FD1959A433F57E71D2212E1DCBD6A12F3FD1FE747FA363C4C787A4D3023F542553C1E2C9CF4F61E28F1BB13042E4AFE3D0FF31
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Dakar

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.856992353568779
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXXMFBx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DKXEBn
                                                                                                                                                                                                                                                MD5:946D3B52F915445DBB8EE8BF67F4EFAB
                                                                                                                                                                                                                                                SHA1:18345968B95E886CA72634D49F2B38F9B29BA629
                                                                                                                                                                                                                                                SHA-256:D50F9732757B284BAC75526F2CFA585DF7F6974160827AFB0FF66124C7CFD361
                                                                                                                                                                                                                                                SHA-512:00B531D1352CF35045EE25C777C7FEA17294E9861E68CE2DE0D9884C05EBDEA84D5F4F0E8B5605721295E25C259979446B7DB76525A633C7D2FA35B38962CF43
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Dar_es_Salaam

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):191
                                                                                                                                                                                                                                                Entropy (8bit):4.8447607449193075
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2Dc8bEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DJbVDR
                                                                                                                                                                                                                                                MD5:7A819572758BC60F4085DF28F1DD1C01
                                                                                                                                                                                                                                                SHA1:0A5BA34EBFBA5A8E8B896713BA527781FC90FF01
                                                                                                                                                                                                                                                SHA-256:AB69948637416219A3D458777990FA4568BEBC89388884BBF129C0E1370A560B
                                                                                                                                                                                                                                                SHA-512:C03E785D1E85292056BB0BDD8DF8326C5DFEB6070AB1C071E1032D14EA69C9DEBC57B2CC7852E35D31652187126CCF0009A6A5C32F9DBB75D56C705535DF05CC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Djibouti

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.829357904445218
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcRHKQ1BQDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DOrkDR
                                                                                                                                                                                                                                                MD5:7981499F9430DC1636C9F834273E0B91
                                                                                                                                                                                                                                                SHA1:1D63F8578420D56E4A5D9D0881FBEC015421E416
                                                                                                                                                                                                                                                SHA-256:E7F7560CCD65D53C446ADAE7128A74D37E17DD0B907A2F2FD85322FB8707B497
                                                                                                                                                                                                                                                SHA-512:3C3F7D78E9A0DE6E2950E1C305EA2DBC986754AE9FB10AC410685F30C39EC235F6F221393099C012E62EE5A7B4F1BED67C96B7B81E90BBA064BA9FE685FE4050
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Douala

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.850101792457859
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcnKe2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dml2D4yn
                                                                                                                                                                                                                                                MD5:44881E75AC32FA95FF6143066EF01B90
                                                                                                                                                                                                                                                SHA1:A221619B4CDE8BE6A181E1F3869EAB665F2E98B8
                                                                                                                                                                                                                                                SHA-256:FCF2DAD148F4D2951320EA99730C56D5EB43D505F37416BE4BAD265CE2902706
                                                                                                                                                                                                                                                SHA-512:4FA67A5F84758366189F0FC4A7FA6C820BA083E1C56EA95D25D21A367F25F76261B7EB5631DFFEB20E095CFD64E770338773F76BD50D4CF6AE29AD3EDFCEC408
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Douala) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\El_Aaiun

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5235
                                                                                                                                                                                                                                                Entropy (8bit):3.541189246992611
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:+eCJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:+eqZSszBrlKcJC9k
                                                                                                                                                                                                                                                MD5:956F5B51FA8BA2E954A0E59AAC8F3276
                                                                                                                                                                                                                                                SHA1:AE35A8502E57EA6EE173E3B42509E4CAC73DA091
                                                                                                                                                                                                                                                SHA-256:5FB102A95B3C004AAB8371840B1A04AC352F48FF9E9EAFDEAAF21960B0F3CAA6
                                                                                                                                                                                                                                                SHA-512:19E7F2574E2B62DF68CC24737F6B94864B3D64B2472BC7D78E6AB5142A1DC1AB3B3700AB802129CB16AED4A4FED29E2B8A5593EE327ADF496255FE2FEF6A7023
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/El_Aaiun) {.. {-9223372036854775808 -3168 0 LMT}.. {-1136070432 -3600 0 -01}.. {198291600 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {1373162400 0 0 +00}.. {1376100000 3600 1 +00}.. {1382839200 0 0 +00}.. {1396144800 3600 1 +00}.. {1403920800 0 0 +00}.. {1406944800 3600 1 +00}.. {1414288800 0 0 +00}.. {1427594400 3600 1 +00}.. {1434247200 0 0 +00}.. {1437271200 3600 1 +00}.. {1445738400 0 0 +00}.. {1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Freetown

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.866631090752554
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcu5sp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dk4DBS
                                                                                                                                                                                                                                                MD5:6C115220CF951FC2EE3C299F86935B6D
                                                                                                                                                                                                                                                SHA1:A1CAB8C710BF20553AF45343118C1726CFE922B7
                                                                                                                                                                                                                                                SHA-256:BC53A4D489F48F14C594C4B0E52079B34E043A5751BBC7DF254A560352243575
                                                                                                                                                                                                                                                SHA-512:E87A4FD145B645DF034182CAD7F9D2BE5B2D9F3A17B6A9B6C84A0B3E846D92EC4C69DF2E85129B7A1AFBC0CCAAC8E3B1D47EB09F0900A82B908E9F6BF63B9736
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Gaborone

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.899477454245453
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcHK0o/4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAV+4Dt
                                                                                                                                                                                                                                                MD5:07222D8ED83CDC456B4D5D84C4BDE320
                                                                                                                                                                                                                                                SHA1:2C657F461FA3F48D56C791AFE4AB7D2EAF45AF60
                                                                                                                                                                                                                                                SHA-256:653AF88955C4418D973E2F8681A99552EB7BE95BCA64C736072F488462F7B373
                                                                                                                                                                                                                                                SHA-512:3016D0636F401BD88BCD460F6A61782E7E8A2C32CE4ECB904C711DF414038A5818F0CA3D7FC671C5ABCE70647FC674A2EF9081C5289EBFD184B44885902E007A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Harare

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.884642061266759
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc0B5h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2Dlfh4Dt
                                                                                                                                                                                                                                                MD5:8666DABE8D196ACD94A9691C592FAF4E
                                                                                                                                                                                                                                                SHA1:9F7EE009DCEAACA79C6EAA6FC73015D595467919
                                                                                                                                                                                                                                                SHA-256:06B82C524585192E0E8FC69DCC1CF86183A8C5EF404645DC413FCF3F8C16B0AB
                                                                                                                                                                                                                                                SHA-512:AAA32FD1B01BFECDD0D1C9C1DF1163374DAFE094C75720EA4095C34F7EAE7DCB594D1A7F6A2A90FB43FF01020F7AEB48E92496E0EE2D039AF23076CD369DD2A7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Harare) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Johannesburg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):309
                                                                                                                                                                                                                                                Entropy (8bit):4.695542624694403
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2DWbzDm2OHePoHvmmXsd//HF2d7d6VcF2d6KsYov:MB862DW7mdHePCvmmcZvF0cVcF/KsFv
                                                                                                                                                                                                                                                MD5:F0E153FC9B978E30742ABC025CA45E02
                                                                                                                                                                                                                                                SHA1:73D96F3188190DAC2453E6F18A1C683CECB9CDE3
                                                                                                                                                                                                                                                SHA-256:5EEF6475E1312051037FCAE3354E32DC0910BE7A5116B71F8CCBE1CCA08D3F1C
                                                                                                                                                                                                                                                SHA-512:E66F4B5FF18BAAD53AFB1ED36A0827115C793075A61F794F26F32BC9F6799DF816A1F817BEB0C0BC938F89E6F5BFBE1AB4F504F1AF518764103FB287746552C7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Johannesburg) {.. {-9223372036854775808 6720 0 LMT}.. {-2458173120 5400 0 SAST}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {-829526400 10800 1 SAST}.. {-813805200 7200 0 SAST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Juba

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1127
                                                                                                                                                                                                                                                Entropy (8bit):4.027824722230131
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5mesdOkMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8M5:5YMV04MSHMzNxMbwM0JXMfCsMzaMq0QJ
                                                                                                                                                                                                                                                MD5:32EC0589260D9D4BCC85FE91E6F04D00
                                                                                                                                                                                                                                                SHA1:BAA269852C4AC6B89EA7941E7A75A007E0CF9EDF
                                                                                                                                                                                                                                                SHA-256:F2646E15488ABF2E960759CEFE5705416E71DA71BB8407B26196244FD1A3394F
                                                                                                                                                                                                                                                SHA-512:4F485453BE1D186ADBE0908852475C63C57BA498091C222EFFB9A5FEA2DB7F55E1BB2DBDBF6AC0F24CC67D47549FA3F5257655B5449B1BCF1FB5CDB27B03D501
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Juba) {.. {-9223372036854775808 7588 0 LMT}.. {-1230775588 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Kampala

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.837466713772859
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcJEl2DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DIEl2V
                                                                                                                                                                                                                                                MD5:E929ED1BC316C71AABE7E625BD562FB1
                                                                                                                                                                                                                                                SHA1:C20C172518C02D93327F4BBBC5D410BFFEF5039D
                                                                                                                                                                                                                                                SHA-256:8EA3028CE2B025F0C457DC8F7601279CA5AF565A88B9FE80208F9F1030F2B0D0
                                                                                                                                                                                                                                                SHA-512:B2FBCF06EACCF18DE97AF1D6BC57D9638E0A36DBF17044FF97F6B9E5089CF9E13E1304F304495324C0ACC1128A7D2D494E7C1FDB95DB0855FCE54F7028096C50
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Khartoum

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1131
                                                                                                                                                                                                                                                Entropy (8bit):4.0421745451318385
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5xe9dSXMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8MM:5hMV04MSHMzNxMbwM0JXMfCsMzaMq0Qc
                                                                                                                                                                                                                                                MD5:2BD3850DDBE2F05BF6F24F3AEFF7516C
                                                                                                                                                                                                                                                SHA1:22B0DBB54E071F30D51A8654CF103F99537F74CD
                                                                                                                                                                                                                                                SHA-256:F475DB8A857A46B310B12C21D6A9BC6CA9FF2960DA429A9D57FA375F9439E13B
                                                                                                                                                                                                                                                SHA-512:1CF82FC07348C697F26625673DA7E3D734358B3FBE69D8E2132CAC0D9F00C7E8CDC353676CD9BAC4CBB9E26CF6638CEAE41DF559E7445D9C453409D7115FFC6C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Khartoum) {.. {-9223372036854775808 7808 0 LMT}.. {-1230775808 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Kigali

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.910322325134086
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcCJRx+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DRX+DEi
                                                                                                                                                                                                                                                MD5:3017253E1C6ACCA8D470A014E4BB321D
                                                                                                                                                                                                                                                SHA1:671B7AC04580B56E2C34F88D123E8296947DDD7E
                                                                                                                                                                                                                                                SHA-256:73FEB807006897B4B485CB82394867444E890265EFE960EC66D6C0E325DA9372
                                                                                                                                                                                                                                                SHA-512:2498C380D761A16C183D78BC1BB18B1D2A1BFCB9C703D86A3FC04CCCE43D88C8D4BC3C47CC31639B78A5FE9C8A7445E9DBB52062E2F3B737DA1E7D0FF70F140A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Kigali) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Kinshasa

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.866127364448228
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcqQFeDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DdD4yn
                                                                                                                                                                                                                                                MD5:41209A335A99803239A854575190C5ED
                                                                                                                                                                                                                                                SHA1:E6EA627C25513B9DDE053F9A24D509AA317C30A1
                                                                                                                                                                                                                                                SHA-256:611375C4901AD6C4844C2BB7D02FB17F34996F49E642546A6784D6F0B28530CC
                                                                                                                                                                                                                                                SHA-512:DF2C0B131F35F54DF5EBF7F8459F98DBABEB6F081247BA95B5D7B41146E2A2EF9BC6B1D909DE57A1223D9C258AB197D9668ED2E111A365C86BABDAA7DF551FB6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Lagos

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):235
                                                                                                                                                                                                                                                Entropy (8bit):4.7936510664790815
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2D4JDm2OHWQvvoHvBsp9boFvoHzIX7uRe6vF9:MB862DymdHWQCvqpmVCzIq
                                                                                                                                                                                                                                                MD5:EC08046589E85D999A597252FF5368B7
                                                                                                                                                                                                                                                SHA1:126E3DE158E1E7AF4737D0AB5B51C0F92F416DC7
                                                                                                                                                                                                                                                SHA-256:DCC9F52F539A67DFD7ABAFDE072ACDAE2B67754C559C8A5FE61979F5A286A066
                                                                                                                                                                                                                                                SHA-512:84B9AB18BC343C8B8934F5FDD2E2EB413925B04D6F5394AA8337B7B55E6487FB071A83A69BD4D0FA40F7F31EBC57B9908729674542CEA3083D700FCD02D77633
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Lagos) {.. {-9223372036854775808 815 0 LMT}.. {-2035584815 0 0 GMT}.. {-1940889600 815 0 LMT}.. {-1767226415 1800 0 +0030}.. {-1588465800 3600 0 WAT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Libreville

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.865878143076229
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcr7bp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dgfp4D4y
                                                                                                                                                                                                                                                MD5:35D8A58EE21E603C6FC4FB896AE6B3D0
                                                                                                                                                                                                                                                SHA1:F1D0A939D761F3F0954F045814CF5339A5597036
                                                                                                                                                                                                                                                SHA-256:AB3E797548C7663CF9ABA7FE163635FF7CAB9E6CB61FA1644C0F7B4B5CCE8B99
                                                                                                                                                                                                                                                SHA-512:97717961987F6B6832C24A7833150CDFE7E82BBEB32DFDB84D2500442AAD9263F8BD4E879591E913D56E9A1991C389EF730211853647A889F358AE3FA37C0185
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Libreville) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Lome

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.862780607964543
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcih4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DNh4D4
                                                                                                                                                                                                                                                MD5:EA21ABBF8B11953916A1C509B8A1B427
                                                                                                                                                                                                                                                SHA1:35ADC230C57B001BE8A99A3D2E34B609A60A1162
                                                                                                                                                                                                                                                SHA-256:EACA9124F17E5B11F27D11FA6141D19EB3AC23E155E155B73467BDAA3BC99AA7
                                                                                                                                                                                                                                                SHA-512:A7972D4F1C5FB988CA04B39E2CDD580F51383BA9D7A66C478275C11A07B8D7A6EFF53A3E1929B0D89F10BCC39D22F285DB2601ED60DB4647C65465643F70C137
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Lome) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Luanda

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.856982839546061
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DccLtBQDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DXQD4yn
                                                                                                                                                                                                                                                MD5:40CD47F6DCF51EBEFEF42489F1716257
                                                                                                                                                                                                                                                SHA1:DF245192A1899A72DE01A57F6969AC060E841734
                                                                                                                                                                                                                                                SHA-256:4C2FD1E44DFAAF0C0DD2EB56B84B538F1E2D84B301AB2CFB8EE7759783501444
                                                                                                                                                                                                                                                SHA-512:D39BEB0EEF344B1A44F7D6A806A1D5B956D7D402648EE0C67C4BA46493236840AF975D89A91B2D33B8AA7D6DC9A051E66718DCDBC1C83B0E964215C2E32ED923
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Luanda) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Lubumbashi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.940313336280723
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcfpT0DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2D8pT0Dt
                                                                                                                                                                                                                                                MD5:71A5DE1276902DB1542840318F9B1AF3
                                                                                                                                                                                                                                                SHA1:AC3825BF343482E0E4D9D6FAA6FCA4D1A125433B
                                                                                                                                                                                                                                                SHA-256:24384EEC359FD24D181AAEF3C017E3C345490A8D352B29D19B1B143A29A811C2
                                                                                                                                                                                                                                                SHA-512:2984EB42A79B8B32BB93DFE71F1C4C0CABFDC9B0A199971347BB3473463FA07FDB5D20227D288BF8653B1BDE347E1297459BBB4C3C34AF7A5434FBF945683577
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Lusaka

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.905174746463853
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcOf+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkDEi
                                                                                                                                                                                                                                                MD5:1D7FDB388535CC59742CA0F1AEE27FBD
                                                                                                                                                                                                                                                SHA1:A99FF2CAC47FD333429C22B271E190D979EEC024
                                                                                                                                                                                                                                                SHA-256:B00801A7279741434D9C2D7EC7322DD93B85EA4F5C9976AB3A43F0AB142E1553
                                                                                                                                                                                                                                                SHA-512:0174D3C6F9116C36C62AD1EB58203EE7DFE8C37F618B8449D5E45AD6290CF8334F28798877D7A563A12EE533026244D6A49BCCF29B5D7FCB5BCC91481D0DDDE2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Malabo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.857096806490649
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcn2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D42D4yn
                                                                                                                                                                                                                                                MD5:1CA9B3E7BCD5BC1CC881453D16B09389
                                                                                                                                                                                                                                                SHA1:1B1964B314E72847D71A42C147CF2BF331B44461
                                                                                                                                                                                                                                                SHA-256:35D56EFFE9E7E60F17B32BD30486E566B635F0AE7A8948D77395B8E6332E26F1
                                                                                                                                                                                                                                                SHA-512:9E08D57B7824F5B076D159D9A5106E51450DF24729C36F485B9B68E8F47E8DFC50F9BEC3F11E0AE6579A8E372A5C0F0DA18A2E797CF2115519D1B4E5B64413DD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Malabo) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Maputo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):149
                                                                                                                                                                                                                                                Entropy (8bit):4.952872531197478
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2DcfKiMXGm2OHoVoHvdSF2I:SlSWB9eg/2DEZDm2OHoVoHvdI
                                                                                                                                                                                                                                                MD5:CD429B6891CBF603A93F9A9733E2391B
                                                                                                                                                                                                                                                SHA1:C6833B83B6D1694AC632018A27915E6F97F708AE
                                                                                                                                                                                                                                                SHA-256:FE6B6A4BE1B61F7F909A3F6137530DFE6D1754499A4D9B0D1CE4952FFF0AE62D
                                                                                                                                                                                                                                                SHA-512:6E57B70B71515998AD617954F9DDAE19968B20946542201153DAB47FBE63790D42F41AE29148ECBCE6D12812879BCF0A4EC881507B62CDB2675AB20267220BF9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Maputo) {.. {-9223372036854775808 7820 0 LMT}.. {-2109291020 7200 0 CAT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Maseru

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):199
                                                                                                                                                                                                                                                Entropy (8bit):4.964472328419063
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DZQs+DWb4n:MByMaHw7NH/t2DZiDWU
                                                                                                                                                                                                                                                MD5:88C8FF2B480648EDADBD0FB93F754275
                                                                                                                                                                                                                                                SHA1:BED7A784C378909914CEB0D303DFE6D05FD576B7
                                                                                                                                                                                                                                                SHA-256:1D80FD86CB733D57D88ECD404E702F750B233ED0CCBFBFFFEED1AAD3B7F1CB04
                                                                                                                                                                                                                                                SHA-512:CB7F831CF099E85B948AE57FCE9D91C7EAAD39753AF82C56EC15B65830EB4115A71BBC83A71A2AC947CAB24DEDDB557E02FAA5A3264546AE6E60607DF6BD2FA3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Mbabane

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):200
                                                                                                                                                                                                                                                Entropy (8bit):4.957246428185456
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DzjEHp4DWb4n:MByMaHw7NH/t2DzjEJ4DWU
                                                                                                                                                                                                                                                MD5:CA7255B86425BA706D214924856B6818
                                                                                                                                                                                                                                                SHA1:E9BE6CF871BB1786E842953D41392299952EC9AC
                                                                                                                                                                                                                                                SHA-256:547197C09C1987350AE5720A4EEC7E8D8F4B9F4A0559726E225E13C707F7C564
                                                                                                                                                                                                                                                SHA-512:23F9AD0F926A0945A17BBC3DCFF9A3D7EE68EC9423EA78985F5FFC60CC61641B57871F9AA703B5FB9BE842DCD4693D0641F9EDED702240873F58D24CD4D60C32
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Mogadishu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.877126792757121
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcBEBXCEeDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DFSVDR
                                                                                                                                                                                                                                                MD5:5C2E2B5189E0E816D5BD7AFC8B49A35E
                                                                                                                                                                                                                                                SHA1:4E43A1ED51399528636D6442B1DDFFD820911407
                                                                                                                                                                                                                                                SHA-256:25E221BE49DEC5547A74AEB91B0041859C59BC866987272A447AB2343D1CC30C
                                                                                                                                                                                                                                                SHA-512:B74735CFAB692756BAADFB1A51A8CC0C986F981D8E7E7A8182370A9017E67439875F0115820A349AFB3BE2FA581A721440968EF817471DD2C5E1286E53B2FE99
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Monrovia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):208
                                                                                                                                                                                                                                                Entropy (8bit):4.8660011420394955
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2D3NPDm2OHrFGxYoHvlHIg5pTwdPsy:MB862D3NbmdHhmYCvdIg5GPsy
                                                                                                                                                                                                                                                MD5:1B3C94B5098E454981C73C1F2AF80164
                                                                                                                                                                                                                                                SHA1:1EBA9E2DBEA70BB1AE5EB13739518AB5A62D2130
                                                                                                                                                                                                                                                SHA-256:2BF0D90610211651127402680519B29AB50B15D344263D0C1A22EDEBE5E01E27
                                                                                                                                                                                                                                                SHA-512:DA4A0BCE7C6750BD7D3BA76B6301B9390723BE0C001C39BE453D80BD87020C2253A75629F68F83C19410D2A75FAF5223A435299CD4AA53DE545EC7C5B5AA54B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Monrovia) {.. {-9223372036854775808 -2588 0 LMT}.. {-2776979812 -2588 0 MMT}.. {-1604359012 -2670 0 MMT}.. {63593070 0 0 GMT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Nairobi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):277
                                                                                                                                                                                                                                                Entropy (8bit):4.655052651600954
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2Dk1Dm2OHsvT5oH99VCV22ufPnVCkVBKBQn9q:MB862DGmdHsvVCjkifvdH9q
                                                                                                                                                                                                                                                MD5:B640661FB37BB74FAB172DBDF1B433E1
                                                                                                                                                                                                                                                SHA1:0236A5B53443A4A18B8B9D6AA7732620BE9A6553
                                                                                                                                                                                                                                                SHA-256:BD8E9765174431C0D403249D3E881C949C83966E9F8162552DA88AE53132467B
                                                                                                                                                                                                                                                SHA-512:53DCC6DF7C3E0B00A6D98A8DCC4988C8CFD6B53CC89E6F8D32DA41CB532A62D9C6A823675C5039F5639CE0D423F6D571F46F5B93FFC7EFFB4EDFFBF89D46AA12
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Nairobi) {.. {-9223372036854775808 8836 0 LMT}.. {-1946168836 9000 0 +0230}.. {-1309746600 10800 0 EAT}.. {-1261969200 9000 0 +0230}.. {-1041388200 9900 0 +0245}.. {-865305900 10800 0 EAT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Ndjamena

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):208
                                                                                                                                                                                                                                                Entropy (8bit):4.856754881865487
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2DjUfDm2OHNseoH1axCXFHzaSmkFWTvF9:MB862DjULmdHPC1XNzaS3yz
                                                                                                                                                                                                                                                MD5:EDB548348E590C8CFE04ED172D96B86C
                                                                                                                                                                                                                                                SHA1:AD3B631FB03819772164402E202AFA781687F597
                                                                                                                                                                                                                                                SHA-256:9ADA5F5AFB25E823E1F0E8AD2489AAA1C09F01356634A9403670D7AB21CA2E2C
                                                                                                                                                                                                                                                SHA-512:17E396A9BE497077B774AD1108CC8760ED35FC92F65FFF070F9ACD3C4FB67A335C1C57DF1CCB1570DE14B708EFCA0063990A969E30759C9A47731DA45ED25EFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ndjamena) {.. {-9223372036854775808 3612 0 LMT}.. {-1830387612 3600 0 WAT}.. {308703600 7200 1 WAST}.. {321314400 3600 0 WAT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Niamey

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.871519187180041
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcdhA9Ff2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dsh2f2D1
                                                                                                                                                                                                                                                MD5:0134039CD1666E983A9B6E43ABD6AF59
                                                                                                                                                                                                                                                SHA1:A2A99345390F4D17C892CEADE58C604257686764
                                                                                                                                                                                                                                                SHA-256:B517120AD8DB3F21EAB4E44A78001EE856EB4EA35852C54CCA96D38887DEBCFA
                                                                                                                                                                                                                                                SHA-512:E5911ADD3D776D87ACFC986C4D2564E3ED9AB12C67F23391ED35FF2A31AD8314B873E31DB8DA4D5E0DAEA12BE34110A8F0C27C9C6126977BAD51C6AD5CDFA39B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Niamey) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Nouakchott

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.909962899502589
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcboGb+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dqbb+c
                                                                                                                                                                                                                                                MD5:550E482599C2F4280F2C258019BB2547
                                                                                                                                                                                                                                                SHA1:A39045BEF313094CEDC100A7D695AE51BC9E498D
                                                                                                                                                                                                                                                SHA-256:64CAF2BF9D45095DF97F419714D5617CF6300ACDB544B621DCE1D594AA9B910C
                                                                                                                                                                                                                                                SHA-512:4FD29C5B4C0D2BDE69C437E9BF4F08A11E1DAAA689B69F28F3551F550BDCCDD055E4C1A241EDB2FA48B18825AFF792F4860F55983E106EA8224F1D87ED4F7546
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Ouagadougou

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.920023025906233
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXCZDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2D1DBS
                                                                                                                                                                                                                                                MD5:6CFC4E938E50C9B591F8CC42A14FA82A
                                                                                                                                                                                                                                                SHA1:FCE14A5CA62C9005C76D27B849A238E76C834F8A
                                                                                                                                                                                                                                                SHA-256:03B9C1FE350B5E9F6F333F9519FA394DCC562308D9388A903AF3D3FECEBDC762
                                                                                                                                                                                                                                                SHA-512:98F22F1D23A9930276A2D306A1473E64DC43547A16CFD01226E4F030A26A3CC4FDED77F790583CC5C078FC6DFCCE81C16A50879AE46A0D3A6F1FA98373F413C7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Porto-Novo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.893842293207225
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcyTKM0DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DQD4yn
                                                                                                                                                                                                                                                MD5:6D979FCD225D5431C7391AE568C6409F
                                                                                                                                                                                                                                                SHA1:6C9DCD222061CC00FD386773C6BB2861F3429A60
                                                                                                                                                                                                                                                SHA-256:8FB8692DB9281AE2B087D704168BFD47D3D0901781FEF65BFD62FCB213BA6B50
                                                                                                                                                                                                                                                SHA-512:32AFA6AF6BFC3D42CA636DD2B96906048EF1ADFBB135BB7E7B77C444FED99FDABB84FBBADF56EC63828FFA7B3371191FF1311822B1C75241EBD9CF602467088E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Sao_Tome

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):234
                                                                                                                                                                                                                                                Entropy (8bit):4.818597723513168
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2DXDm2OHH5oHvzdoH1aNbbFHRMy:MB862DTmdHH5CvzdC16bZRMy
                                                                                                                                                                                                                                                MD5:28A5967C797F4B38FB63F823D6F07168
                                                                                                                                                                                                                                                SHA1:17872E91683B884191D2E4C777FB79DCE6D73EE7
                                                                                                                                                                                                                                                SHA-256:BA1D60DF2B41320F92A123A714E17E576C89383526B96E0541A464C3FBA415B7
                                                                                                                                                                                                                                                SHA-512:B335E3D3268631F3A71F4BAD59740F3A5222344E8223C201B8FE885BAA7F1A550FA7778E498D6DC2111F41053856F50B21413AECCE84B80833EC8176F2A1009C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Sao_Tome) {.. {-9223372036854775808 1616 0 LMT}.. {-2713912016 -2205 0 LMT}.. {-1830384000 0 0 GMT}.. {1514768400 3600 0 WAT}.. {1546304400 0 0 GMT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Timbuktu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.905303708777235
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcHdDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwdDBS
                                                                                                                                                                                                                                                MD5:F2D7F7BC4EA3629EC7F0E45300A0CFD2
                                                                                                                                                                                                                                                SHA1:E7594D378C5DCFEB1E87E13AC79A026260D2E630
                                                                                                                                                                                                                                                SHA-256:9D8009ACAB019B32B1E87AB10E0AC3765ABCABE8066318DA8CA4905D41562F72
                                                                                                                                                                                                                                                SHA-512:795E58172907020C85CF0B10BBA35842D5F92872CCB3382DFDC787BAA504C79927FA23BC3104AD63541A95C44CA80977E8247846DE918A0B00963B970F4823D2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Tripoli

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):954
                                                                                                                                                                                                                                                Entropy (8bit):4.151253074491018
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862DrmdHrCDWR+f7Zn9ueRSmNvlTtuyI/ZBv8dq8Jw4VFZBZYEuAENSfp8kSYx:5veuDkWx3NdT18kbjjAkxTx
                                                                                                                                                                                                                                                MD5:2DF9B050D82B06EB89DA908C31C1F1C9
                                                                                                                                                                                                                                                SHA1:CB294E12560A98D5CEA3BA7004B5519B6C22BAAC
                                                                                                                                                                                                                                                SHA-256:B447B6B1C351E77F22A2D77C0437F2BBB7D8BDFDFDC3D6285E0D260519CC7110
                                                                                                                                                                                                                                                SHA-512:BBE281D551E9F8DA7B6BB08D809177615410A11E4B1184ABD220EA8B1F355B2BBC090C6BAAF7E07FD61286891388ECD4026D4433C4E4B6A8D201F8D95E174532
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tripoli) {.. {-9223372036854775808 3164 0 LMT}.. {-1577926364 3600 0 CET}.. {-574902000 7200 1 CEST}.. {-512175600 7200 1 CEST}.. {-449888400 7200 1 CEST}.. {-347158800 7200 0 EET}.. {378684000 3600 0 CET}.. {386463600 7200 1 CEST}.. {402271200 3600 0 CET}.. {417999600 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {465429600 3600 0 CET}.. {481590000 7200 1 CEST}.. {496965600 3600 0 CET}.. {512953200 7200 1 CEST}.. {528674400 3600 0 CET}.. {544230000 7200 1 CEST}.. {560037600 3600 0 CET}.. {575852400 7200 1 CEST}.. {591660000 3600 0 CET}.. {607388400 7200 1 CEST}.. {623196000 3600 0 CET}.. {641775600 7200 0 EET}.. {844034400 3600 0 CET}.. {860108400 7200 1 CEST}.. {875919600 7200 0 EET}.. {1352505600 3600 0 CET}.. {1364515200 7200 1 CEST}.. {1382662800 7200 0 EET}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Tunis

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1111
                                                                                                                                                                                                                                                Entropy (8bit):4.150944563639585
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862DHmdHjCvbB/lxRjntMVyoKCyFWeey0XSe/OSyHaCgmvLOcSFQSFeSTC6ZPJ:5LemvbplxRhbv+yuh2tIee6kvcw9Cy
                                                                                                                                                                                                                                                MD5:0C99335A41D33AA8BC1EDA0CB4CDCBF5
                                                                                                                                                                                                                                                SHA1:5CABC28D318FA5B8307429EA571FFF91EB8E1252
                                                                                                                                                                                                                                                SHA-256:0760D1028E733888E43E7F1E057217DC2B52786029FCEC67B27EB69CC6A54938
                                                                                                                                                                                                                                                SHA-512:C8FE685ACA46FD4836F3AABC15833F294E5EBED123A487D04E74A8C5668BDFAFB96D2326760452A6E5A1B9CC25AC6C3918D8C10A7F8EF737456640E3000BBA2F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tunis) {.. {-9223372036854775808 2444 0 LMT}.. {-2797202444 561 0 PMT}.. {-1855958961 3600 0 CET}.. {-969242400 7200 1 CEST}.. {-950493600 3600 0 CET}.. {-941940000 7200 1 CEST}.. {-891136800 3600 0 CET}.. {-877827600 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-842918400 3600 0 CET}.. {-842223600 7200 1 CEST}.. {-828230400 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796269600 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766634400 3600 0 CET}.. {231202800 7200 1 CEST}.. {243903600 3600 0 CET}.. {262825200 7200 1 CEST}.. {276044400 3600 0 CET}.. {581122800 7200 1 CEST}.. {591145200 3600 0 CET}.. {606870000 7200 1 CEST}.. {622594800 3600 0 CET}.. {641516400 7200 1 CEST}.. {654649200 3600 0 CET}.. {1114902000 7200 1 CEST}.. {1128038400 3600 0 CET}.. {1143334800 7200 1 CEST}.. {1162083600 3600 0 CET}.. {11747

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Africa\Windhoek

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1649
                                                                                                                                                                                                                                                Entropy (8bit):3.9974091170263066
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5t+Lmcz0iMHHWMbnHoMcHiM0H+MCySHr/MDHqMafHO8MwHJMHHOMHSHWMHHXM5Hs:OLjQDI6jZ2WFcv
                                                                                                                                                                                                                                                MD5:4846FB13467BA93EB134D88228D7F534
                                                                                                                                                                                                                                                SHA1:477FC6144B7DF365606A2E44EF1430F8DF6FB841
                                                                                                                                                                                                                                                SHA-256:DFC3D1FC182B315B31D999BC103C264BD205EB16F971C8636003A71170D7BD7C
                                                                                                                                                                                                                                                SHA-512:A719F5083F66CE44FE047880A10B2ED04B66E01C7F0F7DADAE2FFB95172308F091D669BCFED5A236D2A0F80A4A1D78DA7A778DDE3FAECB40170ECDA705573769
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Windhoek) {.. {-9223372036854775808 4104 0 LMT}.. {-2458170504 5400 0 +0130}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {637970400 7200 0 CAT}.. {764200800 3600 1 WAT}.. {778640400 7200 0 CAT}.. {796780800 3600 1 WAT}.. {810090000 7200 0 CAT}.. {828835200 3600 1 WAT}.. {841539600 7200 0 CAT}.. {860284800 3600 1 WAT}.. {873594000 7200 0 CAT}.. {891734400 3600 1 WAT}.. {905043600 7200 0 CAT}.. {923184000 3600 1 WAT}.. {936493200 7200 0 CAT}.. {954633600 3600 1 WAT}.. {967942800 7200 0 CAT}.. {986083200 3600 1 WAT}.. {999392400 7200 0 CAT}.. {1018137600 3600 1 WAT}.. {1030842000 7200 0 CAT}.. {1049587200 3600 1 WAT}.. {1062896400 7200 0 CAT}.. {1081036800 3600 1 WAT}.. {1094346000 7200 0 CAT}.. {1112486400 3600 1 WAT}.. {1125795600 7200 0 CAT}.. {1143936000 3600 1 WAT}.. {1157245200 7200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Adak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8447
                                                                                                                                                                                                                                                Entropy (8bit):3.867931581740766
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:6hvOs5vveFaHU6lgqN/zNMkixlrxYTMcmo1LWF59:6hvOstgqN/zNMkArxiZmf
                                                                                                                                                                                                                                                MD5:DF52E726B33FA47EB115C1233614E101
                                                                                                                                                                                                                                                SHA1:26B0E49022FCB929F0160617F9C9D2DBEDC63610
                                                                                                                                                                                                                                                SHA-256:77231D179260C08690A70AEE6C2517E4B621ED4794D9AEEA7040539F4FF05111
                                                                                                                                                                                                                                                SHA-512:48AAF25419E07B06E076B0E19F9A0C27EB257556E62FD8F7B2AA963A817823DD89D33AB6AFEAAC2EF2230361D76776355E19CC2BBBB4D19536F823A347AC8AA4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Adak) {.. {-9223372036854775808 44002 0 LMT}.. {-3225223727 -42398 0 LMT}.. {-2188944802 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Anchorage

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8685
                                                                                                                                                                                                                                                Entropy (8bit):3.9620252256806845
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:esKLO6KLC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:etLhN9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                                                                                MD5:BFEACEA04AAA8A69A9AC71CF86BCC15C
                                                                                                                                                                                                                                                SHA1:1693971B8AAA35021BA34799FB1B9FADC3DA0294
                                                                                                                                                                                                                                                SHA-256:DE7FBE2B3ED780C6B82099E1E249DD41F4452A3ADB9DD807B1D0EC06049C2302
                                                                                                                                                                                                                                                SHA-512:E94112A2A5F268C03C58CE3BB4C243B2B9B0FC17CB27FDD58BCD2CCC8D377B805C87A552AE7DE1C5698C5F2C4B0FCAB00A3420B1DAD944C1A2F7A47CE7118F78
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Anchorage) {.. {-9223372036854775808 50424 0 LMT}.. {-3225223727 -35976 0 LMT}.. {-2188951224 -36000 0 AST}.. {-883576800 -36000 0 AST}.. {-880200000 -32400 1 AWT}.. {-769395600 -32400 1 APT}.. {-765378000 -36000 0 AST}.. {-86882400 -36000 0 AHST}.. {-31500000 -36000 0 AHST}.. {-21470400 -32400 1 AHDT}.. {-5749200 -36000 0 AHST}.. {9979200 -32400 1 AHDT}.. {25700400 -36000 0 AHST}.. {41428800 -32400 1 AHDT}.. {57754800 -36000 0 AHST}.. {73483200 -32400 1 AHDT}.. {89204400 -36000 0 AHST}.. {104932800 -32400 1 AHDT}.. {120654000 -36000 0 AHST}.. {126705600 -32400 1 AHDT}.. {152103600 -36000 0 AHST}.. {162388800 -32400 1 AHDT}.. {183553200 -36000 0 AHST}.. {199281600 -32400 1 AHDT}.. {215607600 -36000 0 AHST}.. {230731200 -32400 1 AHDT}.. {247057200 -36000 0 AHST}.. {262785600 -32400 1 AHDT}.. {278506800 -36000 0 AHST}.. {294235200 -3

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Anguilla

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):202
                                                                                                                                                                                                                                                Entropy (8bit):4.908728298285591
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290/8J5290ppv:MByMYbpwt290/8m90b
                                                                                                                                                                                                                                                MD5:1C3CE9F156ABECEAA794E8F1F3A7ADDB
                                                                                                                                                                                                                                                SHA1:6F84D0A424FD2DE85E3420EA320A186B277B0295
                                                                                                                                                                                                                                                SHA-256:F38610019C0A2C18AC71F5AA108B9647D9B5C01DCB55211AFB8312308C41FE70
                                                                                                                                                                                                                                                SHA-512:CA2DA6F9551E4DBF775D7D059F6F3399E0C4F2A428699726CD2A1B0BB17CCF5CDEEF645EE1759A2A349F3F29E0343600B89CE1F4659CF5D2B58280A381C018AD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Anguilla) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Antigua

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.898881450964165
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290//MFe90ppv:MByMYbpwt290//V90b
                                                                                                                                                                                                                                                MD5:DB16FFE76D625DEC731AB6320F5EF9BF
                                                                                                                                                                                                                                                SHA1:D286994E03E4F82C08DE094B436FA098648AFADE
                                                                                                                                                                                                                                                SHA-256:561E58E11DC5A86CAE04B5CB40F43EFCFF9ABC0C841FAC094619E9C5E0B403F8
                                                                                                                                                                                                                                                SHA-512:8842B616205378AF78B0B2FC3F6517385845DE30FFD477A21ACFA0060D161FB6462A3C266DCFD54F101729446B8E1B2ECF463C9CF2E6CE227B2628A19AF365F9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Antigua) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Araguaina

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1782
                                                                                                                                                                                                                                                Entropy (8bit):3.733307964154526
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5KChlvEw6kSSx5H4a8tf3fkuozd23t8VZDG8+GCRRRd:QIlvEwJSSxdF8tfMuozdCt8VZy8+GCRB
                                                                                                                                                                                                                                                MD5:9B01680A362EA7B462DC236F6A35E14C
                                                                                                                                                                                                                                                SHA1:456A5E771F6B749BFDB2BFD59836A6A930499881
                                                                                                                                                                                                                                                SHA-256:B1327CBEC20A21E3FF873E28A2EDFA271EE3A5C01933779300EABD6B185DA010
                                                                                                                                                                                                                                                SHA-512:E6C2F5C489BEA31B0AAC3CB1DB750AC2B665DAC0AC82C1CE6756E768305300297BA5E3B32EDEB9E1715452F02223E47674C4F2B1844920F664623C9F34309240
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Araguaina) {.. {-9223372036854775808 -11568 0 LMT}.. {-1767214032 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Buenos_Aires

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2048
                                                                                                                                                                                                                                                Entropy (8bit):3.7664759014118188
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5p9uuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0wi:jIu3pfe92jCs/VOHv2kdeRtnxafwwfF0
                                                                                                                                                                                                                                                MD5:2B9A1EDE5110B46E24F4726664EA1E3F
                                                                                                                                                                                                                                                SHA1:939D1A7A50544F34B318ACDB52BC6930FE453F6D
                                                                                                                                                                                                                                                SHA-256:BC86AC89121EC4AA302F6259CCC97EFFD7022DC6CEE3B291C57DA72B6EA0C558
                                                                                                                                                                                                                                                SHA-512:C204740DACBCECF2CC5CF4FEB687E86B9150512623203C999D6F4EB5FB246D07681A35C28D8445F6A50F49940C321E0AA5E51FE5A73B8ED076F29CEB5B4D4CA2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Buenos_Aires) {.. {-9223372036854775808 -14028 0 LMT}.. {-2372097972 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Catamarca

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2077
                                                                                                                                                                                                                                                Entropy (8bit):3.742645155048276
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5/nuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0NC:Vuu3pfe92jCs/VOHv2kdeRtnxafww3mP
                                                                                                                                                                                                                                                MD5:3D2AF5714DFC392ED4BC976784D5A58A
                                                                                                                                                                                                                                                SHA1:9252DE40B6EF872E1D2F7CDD53DDD21145E93C5C
                                                                                                                                                                                                                                                SHA-256:A516BB0937977EF949D47B3C8675E30F1CA6C34F8BD298DCF6EBB943580D5317
                                                                                                                                                                                                                                                SHA-512:8D5FFDB5B578B8EA0291D3A21BDDE25F8301CB16B11AE794FFBA8DCFFE46F6AC5EC03D93E511061B132D84E69E5FAF1BB212837EB8A5A4B4BE517F783837E615
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Catamarca) {.. {-9223372036854775808 -15788 0 LMT}.. {-2372096212 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522740

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\ComodRivadavia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):242
                                                                                                                                                                                                                                                Entropy (8bit):4.72138001874583
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/290/MquQ90/MMXAy:MByMY/MYp/MrRt290/MquQ90/MK
                                                                                                                                                                                                                                                MD5:8A609667DE461CEDC1127BE38B161459
                                                                                                                                                                                                                                                SHA1:557D2D55DEA38D1CD1103E183F89C65F4016662B
                                                                                                                                                                                                                                                SHA-256:8CCD6FC77D55582938F1912B1BA66035882D1BFC18A797C631E5E89ABFBF570B
                                                                                                                                                                                                                                                SHA-512:DBAFDA069DB5FDBCBA11050AC91A733C1712BD6395939CFFFC5EAA78BD0B70B4AF2D9FB8954C6841CCF3AC5F8EDCF08E604D3F2CF67F1CBEA5EB6D3C4DC7F2FA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Cordoba

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2043
                                                                                                                                                                                                                                                Entropy (8bit):3.7481312409221594
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5lxQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0n:/xBu3pfe92jCs/VOHv2kdeRtnxafww3j
                                                                                                                                                                                                                                                MD5:8C1D665A25E61CE462C2AC57687763BF
                                                                                                                                                                                                                                                SHA1:B5BBC26CF6A24BD5BEA42AC485D62C789B80905F
                                                                                                                                                                                                                                                SHA-256:FA75E274240A341C6BFE3539CFDC114D125AEAEA3161D3C2409347CF8046042A
                                                                                                                                                                                                                                                SHA-512:A89A7A92C025B87DA4CDFE99BF70CD0E64690D7BFE827DCBFBF0E91B188003FA26487E72B6B950D3BFC9C854B890E5936F414BBEAAD5F3F0673AC5EFE273CDF4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Cordoba) {.. {-9223372036854775808 -15408 0 LMT}.. {-2372096592 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Jujuy

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2041
                                                                                                                                                                                                                                                Entropy (8bit):3.7481290145270245
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5HluuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwcSPAC8OS0E:xwu3pfe92jCs/VOHv2kdeRtnxafwcDCK
                                                                                                                                                                                                                                                MD5:995EDE9E1E86DB500C7437A196325E21
                                                                                                                                                                                                                                                SHA1:4A8FB1511AA124CA2D299EC8DE155EE9D0479180
                                                                                                                                                                                                                                                SHA-256:43EB79ABC03CBAC661C563DE1BC09D9DD855CBC72DD2B6467EA98F0F90421BA9
                                                                                                                                                                                                                                                SHA-512:B58B35EA1B2F0388B8108DCF254F3BD1B21894F00A9F313ABC093BC52C36FCDD94B7486DBA38161C9EFCDB12BC3CD81E7E02395B0CA480A7F01148C43CD3054F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Jujuy) {.. {-9223372036854775808 -15672 0 LMT}.. {-2372096328 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\La_Rioja

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2106
                                                                                                                                                                                                                                                Entropy (8bit):3.744252944523733
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5lduuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0NC:Tou3pfe92jCs/VOHv2kdeRtnxafwwkFP
                                                                                                                                                                                                                                                MD5:4A45A063D45EB94214005EF3CA5BCD6D
                                                                                                                                                                                                                                                SHA1:2420E8591DC53A39EE1A58B2E45DCFAF9503685F
                                                                                                                                                                                                                                                SHA-256:2B018B791E48269FA9EDA12662FFEC3E2DC33603A918E8B735B8D7D6BEB3B3AA
                                                                                                                                                                                                                                                SHA-512:0B2824FA3D40B2EDBE8488D50C30368F4CF6E45A39FF6DEBC5BB4FD86F85AD52F5331AD1EB50E5166FA2E735B7E8AA9D94A5FED9421334DB0499524DBE08F737
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/La_Rioja) {.. {-9223372036854775808 -16044 0 LMT}.. {-2372095956 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Mendoza

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2077
                                                                                                                                                                                                                                                Entropy (8bit):3.738002814507529
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5CPBuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwGSmSc8OSI:GUu3pfe92jCs/VOHv2kdeRtnxafwGJld
                                                                                                                                                                                                                                                MD5:F6CB24E8567B2443224E9E17EE438BFE
                                                                                                                                                                                                                                                SHA1:8029426C30C4C645EA77C6240391CDB1C3107568
                                                                                                                                                                                                                                                SHA-256:DC39400BBFD5BDDDC174FE099194806FBFD3FC3AA20E670D67BE0AC35FE97AD4
                                                                                                                                                                                                                                                SHA-512:6869CFC24C21FBB2DFCCAA9AE7E21A0B24DC002EE792FB28A8F2F05C75C20E93C95A39BD8653AA272AF10FE95922B99EECC1208AACE814817D9441F84360E867
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Mendoza) {.. {-9223372036854775808 -16516 0 LMT}.. {-2372095484 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Rio_Gallegos

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2080
                                                                                                                                                                                                                                                Entropy (8bit):3.7580685839169545
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5oQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0NC:qBu3pfe92jCs/VOHv2kdeRtnxafwwfFP
                                                                                                                                                                                                                                                MD5:212D13CE27AF114A8EC2E04023D218C4
                                                                                                                                                                                                                                                SHA1:C4C5F86BC6EC0D5EA4C9CF199309D085767B97E8
                                                                                                                                                                                                                                                SHA-256:A05B6708DEFF0607396BFC6661C2287341C3432841AE353D94A67AC742B5FAFA
                                                                                                                                                                                                                                                SHA-512:CE7201EEA6A86FB49641410D2EEE4030EDB1B96F3218D764762F5AE23883C796F5742ED69CEC985A9D3582D6C72ED74114DE81508F6DEB4B54865B6974ADC965
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Rio_Gallegos) {.. {-9223372036854775808 -16612 0 LMT}.. {-2372095388 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Salta

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2011
                                                                                                                                                                                                                                                Entropy (8bit):3.7415813345133975
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5NPuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0wF:72u3pfe92jCs/VOHv2kdeRtnxafww3mz
                                                                                                                                                                                                                                                MD5:A06C33CDFD7E7B630CB1DF34E72E61E5
                                                                                                                                                                                                                                                SHA1:694826B9B910DA0BD70A9CB547C26E6838B08111
                                                                                                                                                                                                                                                SHA-256:CAEFC60F2F36EF9FFE0C5921C3C392DE1E95755683A96C1C4EC0BA2C242A4D84
                                                                                                                                                                                                                                                SHA-512:D6696A6C14EECF2B77EC586F40137BDD95E5CE5C5193570C809FAB9E5FCA4B8744283CEB6818E525C73F6EFF657274410B2622902EE8C15912C8D5F5FA5C805E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Salta) {.. {-9223372036854775808 -15700 0 LMT}.. {-2372096300 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\San_Juan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2106
                                                                                                                                                                                                                                                Entropy (8bit):3.747934819596411
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5vXxuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0K:hUu3pfe92jCs/VOHv2kdeRtnxafwwkFl
                                                                                                                                                                                                                                                MD5:32A50D0ABF408D9E59C0580D5B8CC472
                                                                                                                                                                                                                                                SHA1:EA5BB8860982F8BAFEAEFDE1D6ACD440DA132DFE
                                                                                                                                                                                                                                                SHA-256:41B2C25E42146A76934B866061BB3245B8ADA0FF4E1BFBA6F8842A30BDD5C132
                                                                                                                                                                                                                                                SHA-512:E5D2521A4EF53AAD3E74506708EC2768C4D2EE8D6D014DCCF4A6DC290B713B4D46021B66527548C35004E10D753E1B685EEFD55BBE7BF01EC6104D7D8AAC4403
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Juan) {.. {-9223372036854775808 -16444 0 LMT}.. {-2372095556 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\San_Luis

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2081
                                                                                                                                                                                                                                                Entropy (8bit):3.7399269084699975
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5MDuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafw6bS2nZSbdI:yCu3pfe92jCs/VOHv2kdeRtnxafwWnZr
                                                                                                                                                                                                                                                MD5:FB06B66F5D41709C7E85C8B1E9BFCFA0
                                                                                                                                                                                                                                                SHA1:D5C0C4B12C6190856C300321B1C106C7474BA54B
                                                                                                                                                                                                                                                SHA-256:A43B35F25E54EF359D046E33281C0A978F0EE8811C93A6809F1F65750878BBB6
                                                                                                                                                                                                                                                SHA-512:D445F46D6A17A075AD995885E45234A711F53BF3FE2DFC6DFBB611E8AC154B10C91E137927DD66D6A7C596A93BAE5DE283796F341B5095FA0DD05595E1C3A077
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Luis) {.. {-9223372036854775808 -15924 0 LMT}.. {-2372096076 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Tucuman

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2105
                                                                                                                                                                                                                                                Entropy (8bit):3.741704529449777
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5yZujuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OSf:suiu3pfe92jCs/VOHv2kdeRtnxafww3w
                                                                                                                                                                                                                                                MD5:D9497141EC0DC172E5FF5304FED0BE6B
                                                                                                                                                                                                                                                SHA1:CD20A4F0C127A84791093010D59DF119DD32340A
                                                                                                                                                                                                                                                SHA-256:0F7DB23E1280FC19A1FB716E09A9699ADA2AAE24084CAD472B4C325CC9783CCF
                                                                                                                                                                                                                                                SHA-512:0B71952055013CD6045ED209FD98168083550655FAB91B7870C92098E40C4FE6827EAAF922D34ECE28298CBB14327A76AD6780D480E552F52F865AA11A4AA083
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Tucuman) {.. {-9223372036854775808 -15652 0 LMT}.. {-2372096348 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Argentina\Ushuaia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2075
                                                                                                                                                                                                                                                Entropy (8bit):3.7445758155279836
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5SHuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0jE:YOu3pfe92jCs/VOHv2kdeRtnxafwwfFn
                                                                                                                                                                                                                                                MD5:16A89FD2CDEE50E534301A9797311A9D
                                                                                                                                                                                                                                                SHA1:4A4EBA1798214C7CF5ACDC0B2EC8B4716CD968CB
                                                                                                                                                                                                                                                SHA-256:10B6FF51314D8EE1D010187D8805C4E3D71B778BC6DECB26E66193A5BB3E9EA2
                                                                                                                                                                                                                                                SHA-512:DBB0BA3F8AA2B54C86EA8B6530C16DF95AF1331FC5F843B113A204DA20B8EF011FE93C27EB917D01B9040D4914057687B4AACCD292A847559AF69150D1BDC4B5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Ushuaia) {.. {-9223372036854775808 -16392 0 LMT}.. {-2372095608 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Aruba

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):199
                                                                                                                                                                                                                                                Entropy (8bit):4.893042770292303
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290/V90ppv:MByMYbpwt290/V90b
                                                                                                                                                                                                                                                MD5:CC015E3E5D3293CAA1348B4E0EE5795C
                                                                                                                                                                                                                                                SHA1:75E7EFD905C9001CE9CA5872DA3915A19BCB00E0
                                                                                                                                                                                                                                                SHA-256:7490CD66408B8A14C549278FE67DC3338FE9E458F423F01CCBEA00B5E6F6CEF6
                                                                                                                                                                                                                                                SHA-512:66523F050E4A42A1C9FC8C02B822CD3864A6E35F6364FB6A675F2A503BD8030FE6E380B252068668A79A6593B5042520EE40700DA033517742B3F0ED33D79DAF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Aruba) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Asuncion

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7944
                                                                                                                                                                                                                                                Entropy (8bit):3.5156463862656775
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:j7RXBXLqbvdvZsV4GGdzVUFg7XaMOhKpJq3o5GMJq90vRFhjGF3RxTBhcXBACBLo:jEJgXh
                                                                                                                                                                                                                                                MD5:181203CAD98E94355B9914A205514904
                                                                                                                                                                                                                                                SHA1:D361CB53955437270905A9432DE9E7F6C1AE7189
                                                                                                                                                                                                                                                SHA-256:EAEFE21276EE60C7F876C1D65039999AC069339DCDB82A23FC9206C274510575
                                                                                                                                                                                                                                                SHA-512:AE9262DFC35579AEB610DF8BB5F7FBB49232195F55F78402405017681F72C0D2A09FA9EB605B406065A1F44FE6785AC0163870C921DAFFC4746DA6EDA3081521
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Asuncion) {.. {-9223372036854775808 -13840 0 LMT}.. {-2524507760 -13840 0 AMT}.. {-1206389360 -14400 0 -04}.. {86760000 -10800 0 -03}.. {134017200 -14400 0 -04}.. {162878400 -14400 0 -04}.. {181368000 -10800 1 -04}.. {194497200 -14400 0 -04}.. {212990400 -10800 1 -04}.. {226033200 -14400 0 -04}.. {244526400 -10800 1 -04}.. {257569200 -14400 0 -04}.. {276062400 -10800 1 -04}.. {291783600 -14400 0 -04}.. {307598400 -10800 1 -04}.. {323406000 -14400 0 -04}.. {339220800 -10800 1 -04}.. {354942000 -14400 0 -04}.. {370756800 -10800 1 -04}.. {386478000 -14400 0 -04}.. {402292800 -10800 1 -04}.. {418014000 -14400 0 -04}.. {433828800 -10800 1 -04}.. {449636400 -14400 0 -04}.. {465451200 -10800 1 -04}.. {481172400 -14400 0 -04}.. {496987200 -10800 1 -04}.. {512708400 -14400 0 -04}.. {528523200 -10800 1 -04}.. {544244400 -14400 0 -04}.. {5

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Atikokan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.791603790249234
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE/qlOi+4IAcGEu5B:SlSWB9vsM3y7oDSHAIgpdN/290/qlf+M
                                                                                                                                                                                                                                                MD5:5A45B70C79F533548B3DD332F988E15B
                                                                                                                                                                                                                                                SHA1:C7485828619A1D4F5CA59D80ABD197100AC58F64
                                                                                                                                                                                                                                                SHA-256:518BEB6E54AE811F8C725EA8CC42787D48FC605A3476D6E7A00A1B5733CBD6AC
                                                                                                                                                                                                                                                SHA-512:A81C2EBE282E019ED011EADDB8F74C3E6FBE88D87E8D8706B3022CDCC48EF92AD90F9BCF9F25031664BB6EFE069EAFDD23D9B55BF672FC7528A2DD8CB6B986B4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Atikokan) $TZData(:America/Panama)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Atka

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):177
                                                                                                                                                                                                                                                Entropy (8bit):4.812527147763069
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/2IAcGE/ol7x+IAcGs:SlSWB9vsM3y7/yrHAIgp/yH0AN/290/e
                                                                                                                                                                                                                                                MD5:13479F64BFBDC7583C637E1562C454B4
                                                                                                                                                                                                                                                SHA1:2F59484C779B0D6033FC14E205DA9BCAB7A5FCB1
                                                                                                                                                                                                                                                SHA-256:1D6FEE336E71FFFB64874A830C976867C071EBF6B133C296B32F87E3E7D814C9
                                                                                                                                                                                                                                                SHA-512:D2C5D35BBBDAB8D58BF6185328124796C06B67ADFB4C1828BA5A9CCA500A01BB8BE69635AE7EEA7FA837A27B20D488A08A29B121DD1617BC373390AD95D67E39
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:America/Atka) $TZData(:America/Adak)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Bahia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2012
                                                                                                                                                                                                                                                Entropy (8bit):3.703391569010329
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5/ChlvEw6kSSx5H4a8tf3fku+da2XUd23t8VZDG8+GyOd:VIlvEwJSSxdF8tfMu+da2kdCt8VZy8+K
                                                                                                                                                                                                                                                MD5:69DCC2477D8D81E2F49D295DB6907190
                                                                                                                                                                                                                                                SHA1:3C6ED0CEF15D3265C962873480EE1809A4DCACA2
                                                                                                                                                                                                                                                SHA-256:64F1EC14F6B43FF10B564F839152E88DF9262F0947D1DB347557FA902F6FD48C
                                                                                                                                                                                                                                                SHA-512:71DEA6D47F267AA7326A011872FA74762FA4F8CD57EB149E3B56B3DE9097B0B9258BC4F6C29188B49FC60C1942869B92D9E59FEE6980A5DA5D0029C383D99F39
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia) {.. {-9223372036854775808 -9244 0 LMT}.. {-1767216356 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Bahia_Banderas

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2073
                                                                                                                                                                                                                                                Entropy (8bit):4.021485901155292
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:56hey9WUQwuz/V/NF01Y3A6S++S+vS+QQS+1S+9fS+BrS+HoS+8S+/N5S+5zNZf+:5pUIdFS1Y3FUlWQnH7eelN5Lh9LY5Lj
                                                                                                                                                                                                                                                MD5:4655AE5AB9C39CA05C1FF36FC366679F
                                                                                                                                                                                                                                                SHA1:F3F1D08EC35907A8F45AA2CFD097F6DCCA75C9B8
                                                                                                                                                                                                                                                SHA-256:A6233E5BB0D3B30D0E3B94CD797718041AC3C2E75B387D6646A5C0376C5591CD
                                                                                                                                                                                                                                                SHA-512:3915B845A312147C5B047096033B3D153E4E83AF4C8E4AAA73C8D12E2A8386CFE8EC4568730F9F28863017A60622DD9CC7D97991C966779B4068BC29F6C6B2B3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia_Banderas) {.. {-9223372036854775808 -25260 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 1 MDT}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Barbados

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):648
                                                                                                                                                                                                                                                Entropy (8bit):4.251560000277241
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290eWmdH9Colj/uFkv/lC1/uFkOzQs/lps/Ozfah/OzT/lN/uFkX/ll/uFki:5TWeUo5Skv/Y1SkA/g/Bh/m/rSkX/zSt
                                                                                                                                                                                                                                                MD5:DC4FA44B2174A4E6F0644FA8EA2E83F9
                                                                                                                                                                                                                                                SHA1:C12DF8C862A05D569EAF189272F8BF44303595A1
                                                                                                                                                                                                                                                SHA-256:FD5E04136506C6543A9ACDC890A30BCF0D561148E1063EC857E3913DE1EBA404
                                                                                                                                                                                                                                                SHA-512:5AC307CD48132B57215CCBAF0BB63F7FA9C5B28DC9F6217C905885D75B0DF131238D4DB2AE707C3DDEE2EDE6C0914644B435FB1CDD9913600D8B69AE95578B0F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Barbados) {.. {-9223372036854775808 -14309 0 LMT}.. {-1841256091 -14400 0 AST}.. {-874263600 -10800 1 ADT}.. {-862682400 -14400 0 AST}.. {-841604400 -10800 1 ADT}.. {-830714400 -14400 0 AST}.. {-820526400 -14400 0 -0330}.. {-811882800 -12600 1 AST}.. {-798660000 -14400 0 -0330}.. {-788904000 -14400 0 AST}.. {234943200 -10800 1 ADT}.. {244616400 -14400 0 AST}.. {261554400 -10800 1 ADT}.. {276066000 -14400 0 AST}.. {293004000 -10800 1 ADT}.. {307515600 -14400 0 AST}.. {325058400 -10800 1 ADT}.. {338706000 -14400 0 AST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Belem

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1031
                                                                                                                                                                                                                                                Entropy (8bit):3.8842563546204225
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5fe300cChlrLPsw6kSS3h5R14eH8tf3xd:5+CChlvEw6kSSx5H4a8tf3xd
                                                                                                                                                                                                                                                MD5:DFA5E50F6AEF1311A4CF74970477E390
                                                                                                                                                                                                                                                SHA1:5B63676EB8039B2BE767BAA44820F2DAE5B62876
                                                                                                                                                                                                                                                SHA-256:549625CCB30BD0E025BAC47668BA3AA0CDD8569E5887E483C8D62B5B7302FA50
                                                                                                                                                                                                                                                SHA-512:4BBB43694E3B54339C549AC3A5488B77366DB1189D8D1834DCF618D9448084A950B575E207064521B1CDFD2E41F7D1D8C5CD9CEB4668D4459585649556136EB0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belem) {.. {-9223372036854775808 -11636 0 LMT}.. {-1767213964 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Belize

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3284
                                                                                                                                                                                                                                                Entropy (8bit):3.8546064195941097
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5pKSxZwR9IVQU55DG5krgGN8wW+YeD1yyfCwoc:HKSjgIVzrG5krRN8wWheD1yu
                                                                                                                                                                                                                                                MD5:4DA622B685B3B075CC94FC4E23322547
                                                                                                                                                                                                                                                SHA1:DEB23F0A434549DAE1BE60ACF757BB212C907B92
                                                                                                                                                                                                                                                SHA-256:E07F45264E28FD5AA54BD48CB701658509829CF989EC9BD79498D070A1BA270F
                                                                                                                                                                                                                                                SHA-512:9B00BF8870BC4AAEF7F06FCDFEEEF54686A2CC890103696631EB4DEF5AEEAD051EC9069D70A2B22397F18C0067E03A54E75DA18474D6B1BD3BDA2D5313E0AD16
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belize) {.. {-9223372036854775808 -21168 0 LMT}.. {-1822500432 -21600 0 CST}.. {-1616954400 -19800 1 -0530}.. {-1606069800 -21600 0 CST}.. {-1585504800 -19800 1 -0530}.. {-1574015400 -21600 0 CST}.. {-1554055200 -19800 1 -0530}.. {-1542565800 -21600 0 CST}.. {-1522605600 -19800 1 -0530}.. {-1511116200 -21600 0 CST}.. {-1490551200 -19800 1 -0530}.. {-1479666600 -21600 0 CST}.. {-1459101600 -19800 1 -0530}.. {-1448217000 -21600 0 CST}.. {-1427652000 -19800 1 -0530}.. {-1416162600 -21600 0 CST}.. {-1396202400 -19800 1 -0530}.. {-1384713000 -21600 0 CST}.. {-1364752800 -19800 1 -0530}.. {-1353263400 -21600 0 CST}.. {-1333303200 -19800 1 -0530}.. {-1321813800 -21600 0 CST}.. {-1301248800 -19800 1 -0530}.. {-1290364200 -21600 0 CST}.. {-1269799200 -19800 1 -0530}.. {-1258914600 -21600 0 CST}.. {-1238349600 -19800 1 -0530}.. {-1226860200 -21600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Blanc-Sablon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):206
                                                                                                                                                                                                                                                Entropy (8bit):4.938043196147077
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290F490ppv:MByMYbpwt290S90b
                                                                                                                                                                                                                                                MD5:09FD8280CC890F238126F9641DB7C90E
                                                                                                                                                                                                                                                SHA1:98AB4E0DE8173C2BB2532B07FAE2E71F588AB26F
                                                                                                                                                                                                                                                SHA-256:FACD0A835D1F425CD323EE453ADE231810B2D1CF6EBA227BA1B50522AE3879F7
                                                                                                                                                                                                                                                SHA-512:117C24389B7BFB079F4409B1FA6AA547654D7C69A6CBB19218BF2B96F6CFE3CBAAD400D4C2EFE8A9BFE25F44402057427FC8A62DC20A98018D23A7CF9B87401F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Blanc-Sablon) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Boa_Vista

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1199
                                                                                                                                                                                                                                                Entropy (8bit):3.7988385604912893
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5EThevwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQZ:5EHSeSFESoSQSrSsCSeSPS1cSQSQlSsp
                                                                                                                                                                                                                                                MD5:9529221F9B4E104CC598491703B10E6C
                                                                                                                                                                                                                                                SHA1:5ACD61B525A18DE1919A7484C92EC5D787DF2F25
                                                                                                                                                                                                                                                SHA-256:10592EA1CB0D02C06A61059EC601F70A706A5053AC923B9EED29388D5E71EF3A
                                                                                                                                                                                                                                                SHA-512:66BEDB631469651A5E426155428764E3C1C14483E6FEE1505812E8676EB6E82CF0A88F6CC697F03FDA0AF906D91C7DE6E940DF3D33DD247BEF51DBD9A13DEE16
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boa_Vista) {.. {-9223372036854775808 -14560 0 LMT}.. {-1767211040 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Bogota

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):246
                                                                                                                                                                                                                                                Entropy (8bit):4.705337479465446
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/290bJhDm2OHDgoHvcuknov/zEXPKV2kR/uFVEV/KVg:MB86290bLmdHDgCvcukCz8O2Y/uF2/Og
                                                                                                                                                                                                                                                MD5:DB019451A7D678C3E7AEE706283861F6
                                                                                                                                                                                                                                                SHA1:57E63C5372F50CBD1A7FA32688C1B77ADDCC06EB
                                                                                                                                                                                                                                                SHA-256:B6ADC16815DC95E537548CA3572D7F93626A6D1DC390DD4CBABAB5AB855BBA30
                                                                                                                                                                                                                                                SHA-512:6C94B2D7EFA856E6BD41FC45B0E8D16A40E61D8B895397CD71230047FAD4793DDB9ABAAC57D2841549F161C9389D7E61D54D38F1BAC6F13ED3DD4C68CDD3272C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bogota) {.. {-9223372036854775808 -17776 0 LMT}.. {-2707671824 -17776 0 BMT}.. {-1739041424 -18000 0 -05}.. {704869200 -14400 1 -05}.. {733896000 -18000 0 -05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Boise

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8605
                                                                                                                                                                                                                                                Entropy (8bit):3.8563913604109064
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:eSwtktXNmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/jXNDPlLv/PCenJzS6cy
                                                                                                                                                                                                                                                MD5:005D0BF1320030A7E9CDC97D0C8BB44B
                                                                                                                                                                                                                                                SHA1:CB236DA840A49B4BCD261114DCA38DADA567B091
                                                                                                                                                                                                                                                SHA-256:93AF910CB2AD2203B71C1AD49D56DF4A4A14D07F885AFD4E755271F1372A517C
                                                                                                                                                                                                                                                SHA-512:16A5483392741673BEC020EF6EBE963AB0FB12629D662C586C27A1E9A1BE3FEA8DC3D05A0E84917B8166E48CADA45C74DFABFDC897A6BC94D3C5058D31AD5126
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boise) {.. {-9223372036854775808 -27889 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-1471788000 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126255600 -25200 0 MST}.. {129114000 -21600 0 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Buenos_Aires

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):239
                                                                                                                                                                                                                                                Entropy (8bit):4.821972751564724
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7/MQA+zAHAIgp/MQA+zE5N/290BFzk5h490/MQA+zd:MByMY/MV+zhp/MV+zE5t290rzy490/MW
                                                                                                                                                                                                                                                MD5:6700956D5FE96CEC8D34EB49FF805374
                                                                                                                                                                                                                                                SHA1:69B9973EF31AE204EFED7485E59CEA99E00815C8
                                                                                                                                                                                                                                                SHA-256:DEFC5C9DA2D4D4146145A50D692A6BFF698C3B0A1F19EFD82AD0EE7678F39FCF
                                                                                                                                                                                                                                                SHA-512:A80C03A519F00A4270248E885463090A34B3992B3DEBA94DD6AEBCC50736541655461E4AA10856125B8EF9B92CEB697429EE7088DBC6AB4FAE383FDF11521B7A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Buenos_Aires)]} {.. LoadTimeZoneFile America/Argentina/Buenos_Aires..}..set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Cambridge_Bay

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7739
                                                                                                                                                                                                                                                Entropy (8bit):3.8713679494465016
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:zsGaLV9T1sF7Lv/PCewtA8CzSPyDLbrcUia:h5lLv/PCenJzS6cy
                                                                                                                                                                                                                                                MD5:E6AE12CDB55FED492C253E46E2690FE0
                                                                                                                                                                                                                                                SHA1:CD3699E50BC1694827E51E4101C713E52FA646C8
                                                                                                                                                                                                                                                SHA-256:3E0506A54B562DBC3AA6889DDD39B327FE0B85C63B00F0B39D606921A0936A59
                                                                                                                                                                                                                                                SHA-512:BA3D5D5420210E74E74A581C9678224948266828A8FACE06383E41E13475C682F82D288426FB915D618FFE7ED95BD8F1C7E9D59D31CE5B464D5EC1363AB5E340
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cambridge_Bay) {.. {-9223372036854775808 0 0 -00}.. {-1577923200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Campo_Grande

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2918
                                                                                                                                                                                                                                                Entropy (8bit):3.6039149423727013
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:591PSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxSs:5VsE3LMuJALTvn1ZdP7ZbvLfeAh+KIic
                                                                                                                                                                                                                                                MD5:230A9F7A87BA56C30ACB3B1732F823F3
                                                                                                                                                                                                                                                SHA1:8263EA723F2AEA7740C7EC54BE0000A06982D765
                                                                                                                                                                                                                                                SHA-256:6D5BD1355016B03EDEA58DF98BEC26281CD372725B2DCB60B4D748D2FB4346C8
                                                                                                                                                                                                                                                SHA-512:C357AA33833DBBDC6BC7DD3F23469EADDF08564AF17D7EE935C8AEA5F35B6E3BBDE1E181BC0DBF264051C4BE139261055633D191413DD610B0150AB3CDE161AF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Campo_Grande) {.. {-9223372036854775808 -13108 0 LMT}.. {-1767212492 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Cancun

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1412
                                                                                                                                                                                                                                                Entropy (8bit):4.034087321254386
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5s5edTS/uVV3iVP/uaP/uAyAhbS+V8S+FfS+UvS+MS+FB3S+QS+rcS+kS+RS+dSB:5DziZAmELf0On9uhcinzPPoUlWQW3
                                                                                                                                                                                                                                                MD5:7FBCA91F4B7100C4667F24A9AB263109
                                                                                                                                                                                                                                                SHA1:163A77FF9EAC49B00B5F838DF4D47F079ECF6A83
                                                                                                                                                                                                                                                SHA-256:FD6C370F82E5CFE374637E0E222E72570857AC3F85143BEEEF9C3D0E7A6C0D04
                                                                                                                                                                                                                                                SHA-512:124A5D7F58B38F15A90BA48E63D1D38335371D98A2503E691EC6426EB51E87FD61CA05FCA83573DD1DC06DB9E599302C64D226D5DF13B8A62E0A6943318431BE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cancun) {.. {-9223372036854775808 -20824 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {828860400 -14400 1 EDT}.. {846396000 -18000 0 EST}.. {860310000 -14400 1 EDT}.. {877845600 -18000 0 EST}.. {891759600 -14400 1 EDT}.. {902041200 -18000 0 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Caracas

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):284
                                                                                                                                                                                                                                                Entropy (8bit):4.588048586971241
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2909+ETlDm2OHXoHv8HkISlvFVFQVgVJUF/R/OXFxWnVVFQVgVVvR/e:MB86290XmdHXCvydSltvAUeFZ/O/qVva
                                                                                                                                                                                                                                                MD5:5DDB49759D58931A06740A14F76B431C
                                                                                                                                                                                                                                                SHA1:E9AC99265D42D140E12BB4DAAA24FABAC65E79FA
                                                                                                                                                                                                                                                SHA-256:D558C25F165E956E980AA8F554AB3BF24E91B51EADBD2B1065EF6DFDA0E2F984
                                                                                                                                                                                                                                                SHA-512:318804ED41F36A3A8746C8CD286116787A768B06CAD6057559D1C7105170DE6EAB807EFA52AA8A0E353491B6F8C47D623D4473C1AEAD20B5C00747E07BB282B2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Caracas) {.. {-9223372036854775808 -16064 0 LMT}.. {-2524505536 -16060 0 CMT}.. {-1826739140 -16200 0 -0430}.. {-157750200 -14400 0 -04}.. {1197183600 -16200 0 -0430}.. {1462086000 -14400 0 -04}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Catamarca

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):227
                                                                                                                                                                                                                                                Entropy (8bit):4.666638841481612
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/29094SXAFB5290/MMXAy:MByMY/MYp/MrRt290mh5290/MK
                                                                                                                                                                                                                                                MD5:EEB851BE330BCC44A4831763534058B9
                                                                                                                                                                                                                                                SHA1:A5FC3E69DDBD3C40D9EB4317BBD5BB6C78751B36
                                                                                                                                                                                                                                                SHA-256:37CD6BDAA6C6EEDFAC3288CA1C11F5CBBE8A17E5F2E790E7635A64B867AFBD87
                                                                                                                                                                                                                                                SHA-512:7CD0BC822550325EB3198B4AD6CCD38938FA654A03A09C53117560D1FE3FDCD9C892D105F0D7AF44ED52DD7E0475721240D74A10C98619BE9EC4F5410B8FD87D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Cayenne

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.832612867310476
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2IAcGE91INMXGm2OHEFvpoeoHsdR4FIUPvGXFkUwXvp3VVV:SlSWB9eg/2909qDm2OHEdGeoHm4vOXF6
                                                                                                                                                                                                                                                MD5:6052E52C8E5A5F43102C47D895797A1F
                                                                                                                                                                                                                                                SHA1:23DBD40AE96C84E44ADCD1AC33E7871D217C17BC
                                                                                                                                                                                                                                                SHA-256:873285F3E13CB68DD28EB109ECAD8D260E11A9FF6DF6A4E8E0D4C00B0182695B
                                                                                                                                                                                                                                                SHA-512:DDE89C70B6F24AD4F585DC5424A6D029E5C898254C9085C588AE699CED4C8316840FF7C87685D7CFAA2E689F01687985454A0C9E3886342E936C56AB688DF732
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cayenne) {.. {-9223372036854775808 -12560 0 LMT}.. {-1846269040 -14400 0 -04}.. {-71092800 -10800 0 -03}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Cayman

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.774923706273939
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE91mr4IAcGEu5pvn:SlSWB9vsM3y7oDSHAIgpdN/2909Yr49F
                                                                                                                                                                                                                                                MD5:AD6E086BEDF05A0BEB66990BD9518BEE
                                                                                                                                                                                                                                                SHA1:FA0B7E8D6931E79092A90F7EECBA2293AE886AE3
                                                                                                                                                                                                                                                SHA-256:C38C49AE1C3E67BD2118002DCFCC3C0EFB6892FB9B0106908A9282C414D0BF2E
                                                                                                                                                                                                                                                SHA-512:A1E40422D15DBCB24A6FE353639A1541FAD7F394D20F8AEB32D4E39667BA264C3E815BAA703B88B90D381540168016A0641CA220BACAF05E80EAA698642B6FFA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Cayman) $TZData(:America/Panama)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Chicago

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11372
                                                                                                                                                                                                                                                Entropy (8bit):3.814348526052702
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:l6u30Ke1rdJ8SUklvgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:l1EKwdJ8SUkl4aUqtfA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:763E23AA7FB20F8D7CB2F0E87FAFD153
                                                                                                                                                                                                                                                SHA1:B131A10C1C208BB5E5E178ACD21A679FD0537AC5
                                                                                                                                                                                                                                                SHA-256:C7707AF88D650F90839E7258356E39D85228B33B6DBCC5C065C3D8733AE28CEE
                                                                                                                                                                                                                                                SHA-512:FE9C5D2EA253338DDFD79CC8ED2F94D6817BD770C0895752EFB1917E2313735C18475D67191C29BCCD53DEFFF35C1BF0CA5D98C92091DDCD1E97CD6302DC73A4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chicago) {.. {-9223372036854775808 -21036 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-1563724800 -18000 1 CDT}.. {-1551632400 -21600 0 CST}.. {-1538928000 -18000 1 CDT}.. {-1520182800 -21600 0 CST}.. {-1504454400 -18000 1 CDT}.. {-1491757200 -21600 0 CST}.. {-1473004800 -18000 1 CDT}.. {-1459702800 -21600 0 CST}.. {-1441555200 -18000 1 CDT}.. {-1428253200 -21600 0 CST}.. {-1410105600 -18000 1 CDT}.. {-1396803600 -21600 0 CST}.. {-1378656000 -18000 1 CDT}.. {-1365354000 -21600 0 CST}.. {-1347206400 -18000 1 CDT}.. {-1333904400 -21600 0 CST}.. {-1315152000 -18000 1 CDT}.. {-1301850000 -21600 0 CST}.. {-1283702400 -18000 1 CDT}.. {-1270400400 -21600 0 CST}.. {-1252252800 -18000 1 CDT}.. {-1238950800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Chihuahua

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2040
                                                                                                                                                                                                                                                Entropy (8bit):4.006586050664275
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5wE2e49WU0S+VS+TjV/NF01YmM/parZ375+XiBn:5wEvU033FS1YrpaV5+yBn
                                                                                                                                                                                                                                                MD5:67738E07092EDB5A9F484ED5CA217EFB
                                                                                                                                                                                                                                                SHA1:9E428C67AE4BDACA48D189DF60374F3B6523E120
                                                                                                                                                                                                                                                SHA-256:93438D65EA8F95691748FF749219FAFA1940469BC61CED0B7CBF995B417F20B4
                                                                                                                                                                                                                                                SHA-512:57C9FE7EAE37504465F33B2AB079ED91700528E330D227E94AE8A06C58DEFA65F1EA1CDF89F835910D92D037DADB45E684A2EA96512B08F83650DD33CCEB8EB6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chihuahua) {.. {-9223372036854775808 -25460 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 1 MDT}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Coral_Harbour

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                                Entropy (8bit):4.844590153688034
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE9WtEaQXs+IAcGEi:SlSWB9vsM3y7oDSHAIgpdN/2909qEacn
                                                                                                                                                                                                                                                MD5:A0BF04CD77026DC1D2749848AB0EE45E
                                                                                                                                                                                                                                                SHA1:EA0F1BC11379DF2E421675BC5DE4805CE94B96D6
                                                                                                                                                                                                                                                SHA-256:C8CBF5A29CC1D0827390CA6E98B2EFCF90743C6DD0ECA143B300050DD4164041
                                                                                                                                                                                                                                                SHA-512:61968B4E42ECC60C801F959D18D13187AD39D9B81FA1A947F6B6862F99D73E3A30849AC4233DB5705D46F5373C42D8748B15BE9B82822971B4F47E601E5766D8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Coral_Harbour) $TZData(:America/Panama)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Cordoba

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):219
                                                                                                                                                                                                                                                Entropy (8bit):4.78887878252354
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7/MSHAIgp/M1ovN/29093+90/M7:MByMY/M7p/M16t290c90/M7
                                                                                                                                                                                                                                                MD5:C7CCF5CEC7AA60D6063D1C30F4263ADC
                                                                                                                                                                                                                                                SHA1:FD8E9AEEEE50656FD3C694CA051895DDC8E5590B
                                                                                                                                                                                                                                                SHA-256:28B84710EADEF7AD5E7FA63EF519A9D93996D3BB91DD9018333DE3AC4D8FB8DD
                                                                                                                                                                                                                                                SHA-512:6974F8B238977EE5222368C4B79327BB240580819FCA082261D6994781144D81E2E8843B4F1C9D07EFBEE27311C8930BDAC9C0D6D6718F6FB1600D0000576CDE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Costa_Rica

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):431
                                                                                                                                                                                                                                                Entropy (8bit):4.506976345480408
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290lnmdHd5CvZN/Mi3yvI8/uF+wSJz/uF+IA/uF+i/X8/uF+ZDVxNv:5mnedIvZN/e5S+w+S+LS+i0S+pB
                                                                                                                                                                                                                                                MD5:0446EF1A6985A62EDFFB9FFAC7F1DE0E
                                                                                                                                                                                                                                                SHA1:A43468E120E585E2DCC20205BA1D1E2CCB6C0BC2
                                                                                                                                                                                                                                                SHA-256:E3061DC6FA9F869F013351A9FDF420448592D7F959C2B4404093432508146F7E
                                                                                                                                                                                                                                                SHA-512:86D41B0C49489572C3EAEDD5466AA92319C721CCEC9437EBB0F2AAD772FB5ED91A2F2061E00448FB48096B0BAAE9A4E1E644F8AF595B76BE05DBC0C801E6D6ED
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Costa_Rica) {.. {-9223372036854775808 -20173 0 LMT}.. {-2524501427 -20173 0 SJMT}.. {-1545071027 -21600 0 CST}.. {288770400 -18000 1 CDT}.. {297234000 -21600 0 CST}.. {320220000 -18000 1 CDT}.. {328683600 -21600 0 CST}.. {664264800 -18000 1 CDT}.. {678344400 -21600 0 CST}.. {695714400 -18000 1 CDT}.. {700635600 -21600 0 CST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Creston

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.8664633847782905
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/2IAcGE9mM7x/h4y:SlSWB9vsM3y7OBHAIgpONYyHN/2909vr
                                                                                                                                                                                                                                                MD5:0757DD22C0E297CCE8E6678ECA4B39C7
                                                                                                                                                                                                                                                SHA1:81B31299F9A35C8BA2EC1F59EC21129FFCDCD52F
                                                                                                                                                                                                                                                SHA-256:A01DDB460420C8765CE8EF7A7D031ABD7BDB17CFA548E7C3B8574C388AA21E17
                                                                                                                                                                                                                                                SHA-512:F1AFC0F6371A10E4CB74FB2C8985610AEE6C3511861BC09384EDC99D250E9099A1F4430BFC3B0B396C2702BF9991A5A4ECFD53A82C92883460715FA2C1E04579
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:America/Creston) $TZData(:America/Phoenix)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Cuiaba

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2912
                                                                                                                                                                                                                                                Entropy (8bit):3.588248620238414
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5tSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxS1S4:rVsE3LMuJALTvn1ZdP7ZbvLfeAh+KIil
                                                                                                                                                                                                                                                MD5:264E0CEA9491B404993594E64F13479F
                                                                                                                                                                                                                                                SHA1:6D4D277FA470A2C7AD0A59B5DA3CC15BEEB74E78
                                                                                                                                                                                                                                                SHA-256:2D8281CF3FD9E859C5206F781E264854FA876CB36562A08C6C01343C65F8A508
                                                                                                                                                                                                                                                SHA-512:759C19B4DD0E1F7F1176872806BFB1F17ADF9C992E41B96FEA67D77DD67E9DD3C1683E3B6D27FB092C731F534C6A7441BACFFF0301907217A064523B86992E23
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cuiaba) {.. {-9223372036854775808 -13460 0 LMT}.. {-1767212140 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Curacao

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.876961543280111
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2909C4e90ppv:MByMYbpwt290690b
                                                                                                                                                                                                                                                MD5:9459043060E33E8EDC74E78332E96EDF
                                                                                                                                                                                                                                                SHA1:27963FE063965584D0F226BAE9A08EB2954398F0
                                                                                                                                                                                                                                                SHA-256:ACCF08CF53C9431E226714DF8BEDE3C91BAF62D5BD7B98CA8B50D7258124D129
                                                                                                                                                                                                                                                SHA-512:215D9AFAA7227F4447177CE2ABA5A6F7F2F46A9D787845DD32F10D5C22BF9CBE4047AF5E0E66FA7A4F70EEE064A7EC7B67949E565C3C5C60C31F3C19D6915D76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Curacao) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Danmarkshavn

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1128
                                                                                                                                                                                                                                                Entropy (8bit):3.8794180227436557
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5geNrmFQqFi77FkiVFw1ZFt9SFUXDFH9vMF0mFdS/FyMF8AWXF7HFEJF7cSXHVFS:5/vx7O11pbzvZ+S0xAqe12vey
                                                                                                                                                                                                                                                MD5:6E37A78AC686A6B48A78541E1900E33C
                                                                                                                                                                                                                                                SHA1:D41F39FDB6D45921B57341E95A006251B4875961
                                                                                                                                                                                                                                                SHA-256:968C56F1D0106E1D92C7B094EEF528B6EE1FFA3D7A18BE2F2BA59178C2C0F1E0
                                                                                                                                                                                                                                                SHA-512:397623149D95FF9A094750EE697F62DF90124BBBE407FB49FBAE335A61629449F2A61EF4471DBD57745B323DFCF3628611CAE9295F2EF7E4A7412A697651FF68
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Danmarkshavn) {.. {-9223372036854775808 -4480 0 LMT}.. {-1686091520 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -72

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Dawson

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2967
                                                                                                                                                                                                                                                Entropy (8bit):3.9564096415565855
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5IeVvxBn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5zxKKpj/AOZFCARCeQbvb5wxMN6Ix
                                                                                                                                                                                                                                                MD5:F494405F3B250668BE00DC3864B9A2DC
                                                                                                                                                                                                                                                SHA1:20843AD6D95DD5D5950E2946BCAE4ECE2B676F70
                                                                                                                                                                                                                                                SHA-256:30E875343C81C8DE473E6313A27C55315F38E7CCDBD2CEE5783EC54D269D5807
                                                                                                                                                                                                                                                SHA-512:9102BD114436D5FE5A1942E31AE692ECE41F910AC1B6E52C02283801D5AA00CFF22D980C61E69928267D3DD34331E301C7324CA631B71AC2FBBDE06D7914F849
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson) {.. {-9223372036854775808 -33460 0 LMT}.. {-2188996940 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800 0 P

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Dawson_Creek

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1940
                                                                                                                                                                                                                                                Entropy (8bit):4.024810417421672
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5/eUv5wk7Zw9JmnRsw78wP+7bw+7zwN7SynwpBZ7Fwk47H+wW73wo5775w572Iwl:5DuY/YRRvkGZ+R64CjSUlTGS
                                                                                                                                                                                                                                                MD5:7868720D39782147B2BD6B039A5BF7E0
                                                                                                                                                                                                                                                SHA1:6F66404E5CCFF7F020269A316D792D5E7AD4C280
                                                                                                                                                                                                                                                SHA-256:540804BECDEAB92340EF02D32A62BFD550B71A3DB8D829BE426EE4D210004643
                                                                                                                                                                                                                                                SHA-512:9CCD124FF954CA2988F07286FFE9ED740E0CEF5F4D76BF090367B74A577E91BF5590EDFE12AFC83ACF5CBFC88C5A68867C58082A2777D08C326A7B18889B08E2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson_Creek) {.. {-9223372036854775808 -28856 0 LMT}.. {-2713881544 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400082400 -25200 1 PDT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Denver

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8920
                                                                                                                                                                                                                                                Entropy (8bit):3.8540632258197514
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:gjGtwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:gUwDPlLv/PCenJzS6cy
                                                                                                                                                                                                                                                MD5:0D649599A899ECB3FCF2783DCEE3E37B
                                                                                                                                                                                                                                                SHA1:ACC796BE75F41A12FB1F8CCBD2B2839AF9876FFE
                                                                                                                                                                                                                                                SHA-256:3FE2EE8C05C5D6F268B58BD9FC3E3A845DEA257473B29F7B3FB403E917448F3C
                                                                                                                                                                                                                                                SHA-512:C10D41AB95439B8E978F12F9F58D1ACC9AD15404123FA5FBA0D1CC716E5CF5DA6BD2252450055AC3998DBCB8DD49F7A82ACD53413E3EE78CDA2C42F603DE2C56
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Denver) {.. {-9223372036854775808 -25196 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-1577898000 -25200 0 MST}.. {-1570374000 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1538924400 -21600 1 MDT}.. {-1534089600 -25200 0 MST}.. {-883587600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-757357200 -25200 0 MST}.. {-147884400 -21600 1 MDT}.. {-131558400 -25200 0 MST}.. {-116434800 -21600 1 MDT}.. {-100108800 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -2

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Detroit

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8430
                                                                                                                                                                                                                                                Entropy (8bit):3.826664943157435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:SGiS1A5tCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:SG/K5ItON0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:2BBA922E9377D257CBDF6E1367BBB1A2
                                                                                                                                                                                                                                                SHA1:6F33A44834E8041E78660A326A5DDAF3D7F9DC2A
                                                                                                                                                                                                                                                SHA-256:84F6897B87D3978D30D35097B78C55434CE55EB65D6E488A391DFC3B3BB5A8FE
                                                                                                                                                                                                                                                SHA-512:D225824945C08A3521A8288B92B26DFFA712ED3505E72DEDE4A7D1777E58DEA79ADF3F042D22624E4142DD4203BAA4DFF8EB08B7033FDF00059F6C39954EA1A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Detroit) {.. {-9223372036854775808 -19931 0 LMT}.. {-2051202469 -21600 0 CST}.. {-1724083200 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-757364400 -18000 0 EST}.. {-684349200 -14400 1 EDT}.. {-671047200 -18000 0 EST}.. {-80506740 -14400 0 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {94712400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {157784400 -18000 0 EST}.. {167814000 -14400 0 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Dominica

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):202
                                                                                                                                                                                                                                                Entropy (8bit):4.86856578093135
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290TL3290ppv:MByMYbpwt290Tr290b
                                                                                                                                                                                                                                                MD5:398D8DBB24CEA2D174EF05F63869C94A
                                                                                                                                                                                                                                                SHA1:6D0E04165952E873E6ECA33A0E54761B747F0A98
                                                                                                                                                                                                                                                SHA-256:3DA98AA7D3085845779BE8ED6C93CCBDA92191F17CA67BBF779803E21DA2ABF3
                                                                                                                                                                                                                                                SHA-512:2652AFD1A3F8A4B84078A964005FE10C64491EC2D47CDE57D5066D07D1D837308FD696F53B9E7B6B0E72F86F9A85128B8CBF5F302F91EADE6D840DF946DE85CD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Dominica) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Edmonton

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8600
                                                                                                                                                                                                                                                Entropy (8bit):3.8579895970456137
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:7SabOGaLm911sF7Lv/PCewtA8CzSPyDLbrcUia:7vf4lLv/PCenJzS6cy
                                                                                                                                                                                                                                                MD5:EBD169ECA4D45EED28BF7B27809361BC
                                                                                                                                                                                                                                                SHA1:E89C8484A29D792FB6349CFDFDD30C2FA6B78B6B
                                                                                                                                                                                                                                                SHA-256:026D51D73D30A3710288F440E0C337E44E3A14D0AA2D7B6C6E53AF43FC72A90C
                                                                                                                                                                                                                                                SHA-512:45C936ED7D4AF95261180547013454AAEC9FA7672B52AC6077DD99D9FEB6DDD57652FE4EC67BF81F1588384F3027A1872E0C72D9CAEB980B66D2CB6EE9B8ABB0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Edmonton) {.. {-9223372036854775808 -27232 0 LMT}.. {-1998663968 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1600614000 -21600 1 MDT}.. {-1596816000 -25200 0 MST}.. {-1567954800 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1536505200 -21600 1 MDT}.. {-1523203200 -25200 0 MST}.. {-1504450800 -21600 1 MDT}.. {-1491753600 -25200 0 MST}.. {-1473001200 -21600 1 MDT}.. {-1459699200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {136371600 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {167821200 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {23072

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Eirunepe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1230
                                                                                                                                                                                                                                                Entropy (8bit):3.7989525000422963
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5OXUepdkZss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6w:5OXCZsMw57XJh4CxUF/A6GTrtSUUhfL0
                                                                                                                                                                                                                                                MD5:6766E75702D8C2D1C986DFCEFCE554F9
                                                                                                                                                                                                                                                SHA1:39553F80D82BC0134FAF70C9830B96BDCBCEFF1C
                                                                                                                                                                                                                                                SHA-256:48FC987E5999EA79F24797E0450FE4DAB7CF320DFAD7A47A8A1E037077EC42C9
                                                                                                                                                                                                                                                SHA-512:A812D0D4254BB0B7DB7AE116652D2A8F97D22C59F2709A17D1CE435FCFB38B807A4E0ED6EA114A66897E29D85226875FA84D28B254A5D17BD1CBA95FAD8349B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Eirunepe) {.. {-9223372036854775808 -16768 0 LMT}.. {-1767208832 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {571204800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\El_Salvador

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):279
                                                                                                                                                                                                                                                Entropy (8bit):4.760311149376001
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/29078iPDm2OHvJ4YoHxHhgdrV/uF+IcmJ3/uF+ivNv:MB8629078AmdHx4YCJSB/uF+QV/uF+w9
                                                                                                                                                                                                                                                MD5:CEF7277443EB6990E72C7EA7F79A122C
                                                                                                                                                                                                                                                SHA1:1D3FEA364B3DC129DE3998A1455D5588EBAA6FF8
                                                                                                                                                                                                                                                SHA-256:C02C6E79398553BD07BEA0BE4B7F0EBDD8BC821595909CFFB49DE4290A0D1D0F
                                                                                                                                                                                                                                                SHA-512:E6FC530B2CCF010B8D38BC3F49A6859B5C68F4AB604E6305CE75FBE4FC9FF3FCD0187DEBEF6DAE652EEF9695568DBDE31F426E404CC3CC206D78183E0D919234
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/El_Salvador) {.. {-9223372036854775808 -21408 0 LMT}.. {-1546279392 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Ensenada

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.836337676384058
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/2IAcGE7JM7QIAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/2907390eB
                                                                                                                                                                                                                                                MD5:005D9C0E50291616A727CFB74A9FD37E
                                                                                                                                                                                                                                                SHA1:846AE6720382B4F67B37B4256E45246C81DAF899
                                                                                                                                                                                                                                                SHA-256:3E363BF82545F24CCE8CFA6EEC97BA6E1C2A7730B2A9CE6C48F784821D308A5D
                                                                                                                                                                                                                                                SHA-512:452326D11D01825764BC40A77D17444D822F3AA202582233DD8B122798478FA83E3A27A02508EAC4CF0C7922AC2563742D773AA870562AE496B34FBB41FBAD63
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Ensenada) $TZData(:America/Tijuana)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Fort_Nelson

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4578
                                                                                                                                                                                                                                                Entropy (8bit):3.8944281193962818
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5QIgsB/YRRvkGZ+R64CjSUlTG5Al5pj/A1ZFCARCeQbvb5+:6IgzR864CjSETG5sjgZkR/bvt+
                                                                                                                                                                                                                                                MD5:4A4E023F635C4202018EA9E8F85B5047
                                                                                                                                                                                                                                                SHA1:38E121FE2D419413E9E791B6C22BFC8D9F7554BC
                                                                                                                                                                                                                                                SHA-256:AB15023807E7C7D1026C9970D190F1B405D48952464025242C2BB6C6BBB8391A
                                                                                                                                                                                                                                                SHA-512:F10D21A2C841224879D1C817FC7F477DF582E1BC3603666B55199C098D51D1D5429F8C088C1083C07FC7588AE5C42A1DFBCC6B7C636AD1BE84ED657807A229E5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fort_Nelson) {.. {-9223372036854775808 -29447 0 LMT}.. {-2713880953 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Fort_Wayne

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):231
                                                                                                                                                                                                                                                Entropy (8bit):4.778858143786314
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/290HXYAp4903GK8:MByMY3GK7Kp3GKnt290Hz4903GK8
                                                                                                                                                                                                                                                MD5:24C369A3091452DCA7AAEBF4F48F5289
                                                                                                                                                                                                                                                SHA1:2C2174CB16F490689E6FAC17B6D18F4A0DBD2DC9
                                                                                                                                                                                                                                                SHA-256:C8948616262CF6990739343ABBBD237E572DB49310099E21DD8F9E317F7D11B3
                                                                                                                                                                                                                                                SHA-512:80F579572754579706B4EEA49BF30456F3231A308E0616DC430E2428A04992412773421542E4F7FE4E4C7491BA88942FA44B49E87E95A2183211AC2AB523B231
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Fortaleza

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1423
                                                                                                                                                                                                                                                Entropy (8bit):3.784027854102512
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5MeajcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaIBXR8nd:5rChlvEw6kSSx5H4a8tf3fkuoYVZDNRo
                                                                                                                                                                                                                                                MD5:E7939C9A3F83D73B82A6DE359365EFD4
                                                                                                                                                                                                                                                SHA1:06D6E257DA7C317CAFAF6C0B04567A2453CC1660
                                                                                                                                                                                                                                                SHA-256:C0A836BDAF07F0376B7B0833A0AB3D52BA6E3E1D6F95E247E1AD351CD1096066
                                                                                                                                                                                                                                                SHA-512:E2BEA04084489B26ADD9A768D2580C1FF7EBAC8A3EA36818F49E85FB14E01500D59D53904F5A17F4DABEF27B4CC2FC3F977EE4C125E5CE739BBE90C130ED3B07
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fortaleza) {.. {-9223372036854775808 -9240 0 LMT}.. {-1767216360 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Glace_Bay

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8372
                                                                                                                                                                                                                                                Entropy (8bit):3.8225708746657316
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:w4lTPB10KvnpNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/BI:wKCC
                                                                                                                                                                                                                                                MD5:1C8B0B85BB5578E84A4867546111F946
                                                                                                                                                                                                                                                SHA1:E08A96F5B369FA53BC1F3F839EC14FF9D334F727
                                                                                                                                                                                                                                                SHA-256:58C207CBD9DE7A7BB15E48A62CEA9F15DA184B945133DEE88EFF29FD8B66B29E
                                                                                                                                                                                                                                                SHA-512:54CFBF208AB3E58AFB6BEC40265A452A3C4C684D7F278F51D6495FCA544652A1A5E05BC45F600911191B33C936E5D7D43A28FD2B0884AAB9F63B7AD5EFD574A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Glace_Bay) {.. {-9223372036854775808 -14388 0 LMT}.. {-2131646412 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-536443200 -14400 0 AST}.. {-526500000 -10800 1 ADT}.. {-513198000 -14400 0 AST}.. {-504907200 -14400 0 AST}.. {63086400 -14400 0 AST}.. {73461600 -10800 1 ADT}.. {89182800 -14400 0 AST}.. {104911200 -10800 1 ADT}.. {120632400 -14400 0 AST}.. {126244800 -14400 0 AST}.. {136360800 -10800 1 ADT}.. {152082000 -14400 0 AST}.. {167810400 -10800 1 ADT}.. {183531600 -14400 0 AST}.. {199260000 -10800 1 ADT}.. {215586000 -14400 0 AST}.. {230709600 -10800 1 ADT}.. {247035600 -14400 0 AST}.. {262764000 -10800 1 ADT}.. {278485200 -14400 0 AST}.. {294213600 -10800 1 ADT}.. {309934800 -14400 0 AST}.. {325663200 -10800 1 ADT}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Godthab

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.973070790103308
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wQbSeyXHAIg20wQboAFARL/2IAcGE5GZJ4IAcGEH:SlSWB9vsM3y7lbSeSHAIgplbLFAN/291
                                                                                                                                                                                                                                                MD5:8263D2B39C2EC3B38A179F8BAD5972DD
                                                                                                                                                                                                                                                SHA1:18D3462F6846768E16036E860DE90FB345C93047
                                                                                                                                                                                                                                                SHA-256:5FB2CFBA25CE2F49D4C3911AFF8E7E1FF84EFC2D01F5783772E88246BFBC56AC
                                                                                                                                                                                                                                                SHA-512:C175CAF972459759553001D48921268E9C6268CED56021BA6339F8CE3DD032DA6180E2B82974D3DCD0DC5F21566DFDBFBE1B6CF24E5E893F2335A449452DB27F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Nuuk)]} {.. LoadTimeZoneFile America/Nuuk..}..set TZData(:America/Godthab) $TZData(:America/Nuuk)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Goose_Bay

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10353
                                                                                                                                                                                                                                                Entropy (8bit):3.864463676759425
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:zfSacO8f7/ewzlrfFj18KvnpNWMPm4bPJvSuYUHgA0G19OBYEi/B51B7/Bm6BTdW:zfSacOI7/V3SuYUHgAuCC
                                                                                                                                                                                                                                                MD5:0D646C67105FD0525E7CCC79585CE9DF
                                                                                                                                                                                                                                                SHA1:06D91FDD8FEEDC299E40079569372F97A9AC6F04
                                                                                                                                                                                                                                                SHA-256:52D2478289682BF95BFB93D64D679E888C9D23C0F68DFFF7E6E34BFC44B3D892
                                                                                                                                                                                                                                                SHA-512:FD672613C2B65E12425415630A2F489917EB80DDED41338C9AA7D5D3C6B54E52C516A32493593F518DACF22A91D7A9D2C96DB9C5F1BE2C3BB9842D274BDC04FF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Goose_Bay) {.. {-9223372036854775808 -14500 0 LMT}.. {-2713895900 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1096921748 -12600 0 NST}.. {-1072989000 -12600 0 NST}.. {-1061670600 -9000 1 NDT}.. {-1048973400 -12600 0 NST}.. {-1030221000 -9000 1 NDT}.. {-1017523800 -12600 0 NST}.. {-998771400 -9000 1 NDT}.. {-986074200 -12600 0 NST}.. {-966717000 -9000 1 NDT}.. {-954624600 -12600 0 NST}.. {-935267400 -9000 1 NDT}.. {-922570200 -12600 0 NST}.. {-903817800 -9000 1 NDT}.. {-891120600 -12600 0 NST}.. {-872368200 -9000 0 NWT}.. {-769395600 -9000 1 NPT}.. {-765401400 -12600 0 NST}.. {-757369800 -12600 0 NST}.. {-746044200 -9000 1 NDT}.. {-733347000 -12600 0 NST}.. {-714594600 -9000 1 NDT}.. {-701897400 -12600 0 NST}.. {-683145000 -9000 1 NDT}.. {-67044

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Grand_Turk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7522
                                                                                                                                                                                                                                                Entropy (8bit):3.84007813579738
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:pGStCt/cL1BRv0HY2iU7KKdFL6Aa2K4gSLf8e:pvItOx0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:A17723CE27EC99D1506C45AB1531085B
                                                                                                                                                                                                                                                SHA1:A83ED7BD09514A829CC8F2EA47BA113F5DCA1090
                                                                                                                                                                                                                                                SHA-256:560B39485CED4C2A0E85A66EB875331E5879104187D92CB7F05C2F635E34AC99
                                                                                                                                                                                                                                                SHA-512:110D1253D6915DB046247E4FD3BA9B881146BC3896DE779215E0CC6D1DCC59958C355441955509F5D38E3A3BA166DFD0F2F277000E9E89D6551FBEA0C16974B9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Grand_Turk) {.. {-9223372036854775808 -17072 0 LMT}.. {-2524504528 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {284014800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Grenada

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.892013473075135
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2905Qb90ppv:MByMYbpwt290Ob90b
                                                                                                                                                                                                                                                MD5:4B9ABEA103F55509550F8B42D88E84B7
                                                                                                                                                                                                                                                SHA1:E3AA1BCE5E260264E74F77E59C4071B7E496AB41
                                                                                                                                                                                                                                                SHA-256:EBED070E8E67C5F12FF6E03FE508BE90789F17C793DFE61237B4045B8222580F
                                                                                                                                                                                                                                                SHA-512:568E375464FF264C5048CB35995945BDE1D5BCC3A108B2A4D0F8389EBF18B4C58EBB1C2122F10BA777D512504A59C7EFDF6069EABD2A5DEA3189204B7F7A6EB4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Grenada) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Guadeloupe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.9138787435596765
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2905AJLr490ppv:MByMYbpwt290qJLr490b
                                                                                                                                                                                                                                                MD5:92B091A06198E233B73DF12DFCD818D5
                                                                                                                                                                                                                                                SHA1:C529488D09F86755E4F22CB4F0E3013C3A1B978D
                                                                                                                                                                                                                                                SHA-256:6CB1930532831D12057FCB484C60DB64A60A4F6D8195DAFD464826923116A294
                                                                                                                                                                                                                                                SHA-512:55EAE03CDECAC43BEDD3AA1A32C632A46808F29FF4D97A330F818544E4D10B9E9BA909D6627C38065EB7AC8E2C395FA37797F532CCFC8AB89D4698CCDE17F985
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Guadeloupe) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Guatemala

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):399
                                                                                                                                                                                                                                                Entropy (8bit):4.513185345162455
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862906GGmdHKznC972f/uF+mP/uF+K67Jqd3/uF+eBxE/uF+DAWNv:5neQCgfS+6S+K67Yd3S+e0S+1
                                                                                                                                                                                                                                                MD5:569CDE7CE1AB84C0F16A25E85A418334
                                                                                                                                                                                                                                                SHA1:EADE79AB6EDD98C7FE8B10B480C5C530CA014F5C
                                                                                                                                                                                                                                                SHA-256:14F6A98D602F3648C816B110F3A0BA375E1FFE8FA06BEEAB419DC1ABFA6EDCAF
                                                                                                                                                                                                                                                SHA-512:AE2ACBF09EED857906811BE2984D6BF92BF2955A9FE2F9F3FFEBB6790902F5C2C870F8561CA13AD9CB7826EECA434BED7CFE7D0D2739996BACEE506D0EB730DC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guatemala) {.. {-9223372036854775808 -21724 0 LMT}.. {-1617040676 -21600 0 CST}.. {123055200 -18000 1 CDT}.. {130914000 -21600 0 CST}.. {422344800 -18000 1 CDT}.. {433054800 -21600 0 CST}.. {669708000 -18000 1 CDT}.. {684219600 -21600 0 CST}.. {1146376800 -18000 1 CDT}.. {1159678800 -21600 0 CST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Guayaquil

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):249
                                                                                                                                                                                                                                                Entropy (8bit):4.745656594295655
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2905xDm2OHHjGeoHv5laITicKpKV0EX/uFhfF/KVg:MB86290jmdHHLCv5FT/gOR/uFpF/Og
                                                                                                                                                                                                                                                MD5:DF661E312C6CE279CD6829120BE33CF2
                                                                                                                                                                                                                                                SHA1:4ACDB31E27EF9175C5452BF95F94F9BC280A237F
                                                                                                                                                                                                                                                SHA-256:6806AA5814BDC679C6EF653C518D2699114BE71D973F49C0864F622038DC2048
                                                                                                                                                                                                                                                SHA-512:04E7FD01F4DAD981EE8A02487F4A889015C41D07D6DCF420183D387E2188FF3239E345B5D65FB195CA485F5C7B4AD8CFEF51FFFC11EE0C91F0C88FF7B7EF17C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guayaquil) {.. {-9223372036854775808 -19160 0 LMT}.. {-2524502440 -18840 0 QMT}.. {-1230749160 -18000 0 -05}.. {722926800 -14400 1 -05}.. {728884800 -18000 0 -05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Guyana

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):248
                                                                                                                                                                                                                                                Entropy (8bit):4.673559445766137
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2905R3SDm2OHRLx5oH8ZOXFxSyZ1yV/KMMdVVFAKFZ4KVR/ON:MB86290LGmdHBnC8ZODhyV/4d/OeZ4Ke
                                                                                                                                                                                                                                                MD5:F06C226D8D53EF8859AD91D7EBA5959C
                                                                                                                                                                                                                                                SHA1:E0B4E6F4ADCB10F1D79FFD928E8684FFE0C0DC5F
                                                                                                                                                                                                                                                SHA-256:4078D2E361D04A66F22F652E3810CDF7F630CF89399B47E4EC7B1D32B400FD85
                                                                                                                                                                                                                                                SHA-512:B4385650A0C69B7BD66415CC4BB9FCA854DBB1427E9F2D6C1D8CDB8CCEF9ECBD699C66A83A9AC289DABC5CDBB0A2B044E4097E9A2977AE1802B3BF6E2BB518CF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guyana) {.. {-9223372036854775808 -13959 0 LMT}.. {-1843589241 -14400 0 -04}.. {-1730577600 -13500 0 -0345}.. {176096700 -10800 0 -03}.. {701841600 -14400 0 -04}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Halifax

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11124
                                                                                                                                                                                                                                                Entropy (8bit):3.8106487461849885
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:YpQamC9XD81iWQSufutTLBCN8RWnWQ7Z/xVpmtBwXiCDLxcGMe++wzlrfFj10Kvn:2kXCvNc/1/CC
                                                                                                                                                                                                                                                MD5:6FB9E47841FF397CE36A36C8280E2089
                                                                                                                                                                                                                                                SHA1:DA210300DC3D94FC3D8BA0A4531341BCA5C5936C
                                                                                                                                                                                                                                                SHA-256:01E11C7B07925D05E9E1876C310A2B87E0E80EF115D062225212E472B7A964F1
                                                                                                                                                                                                                                                SHA-512:F61B5A8A7532BBD54A4976DF17A1C6CF51BCC6DC396482FBE169C3081AF27B6CA863F0CDE3E483C59F5A5BD3365592F6984A97173C736B41D3CEEDAD4263A4E5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Halifax) {.. {-9223372036854775808 -15264 0 LMT}.. {-2131645536 -14400 0 AST}.. {-1696276800 -10800 1 ADT}.. {-1680469200 -14400 0 AST}.. {-1640980800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1609444800 -14400 0 AST}.. {-1566763200 -10800 1 ADT}.. {-1557090000 -14400 0 AST}.. {-1535486400 -10800 1 ADT}.. {-1524949200 -14400 0 AST}.. {-1504468800 -10800 1 ADT}.. {-1493413200 -14400 0 AST}.. {-1472414400 -10800 1 ADT}.. {-1461963600 -14400 0 AST}.. {-1440964800 -10800 1 ADT}.. {-1429390800 -14400 0 AST}.. {-1409515200 -10800 1 ADT}.. {-1396731600 -14400 0 AST}.. {-1376856000 -10800 1 ADT}.. {-1366491600 -14400 0 AST}.. {-1346616000 -10800 1 ADT}.. {-1333832400 -14400 0 AST}.. {-1313956800 -10800 1 ADT}.. {-1303678800 -14400 0 AST}.. {-1282507200 -10800 1 ADT}.. {-1272661200 -14400 0 AST}.. {-1251057600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Havana

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8729
                                                                                                                                                                                                                                                Entropy (8bit):3.8227313494100867
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:BEsWduCtQA/gF6Y3Umjm67yLb5RCzhV28I:BBWACb/gF6Y3UmjBy7
                                                                                                                                                                                                                                                MD5:564980AECB32F5778422EA15E8956879
                                                                                                                                                                                                                                                SHA1:545209C95043721C1839CCE5FEFD1A6F2DE3FE5F
                                                                                                                                                                                                                                                SHA-256:96B62BFBF0C05CF970245597C691F89EBF631175796459642A85287F131D0215
                                                                                                                                                                                                                                                SHA-512:25FE5DAA55E3466EAE1CDC73918F189403C3360D4E82D72D745FA04A374DE04F479AA9811D6154FC70CC8EA620F18035EA6A3074116806D4405936FA017CE8E6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Havana) {.. {-9223372036854775808 -19768 0 LMT}.. {-2524501832 -19776 0 HMT}.. {-1402813824 -18000 0 CST}.. {-1311534000 -14400 1 CDT}.. {-1300996800 -18000 0 CST}.. {-933534000 -14400 1 CDT}.. {-925675200 -18000 0 CST}.. {-902084400 -14400 1 CDT}.. {-893620800 -18000 0 CST}.. {-870030000 -14400 1 CDT}.. {-862171200 -18000 0 CST}.. {-775681200 -14400 1 CDT}.. {-767822400 -18000 0 CST}.. {-744231600 -14400 1 CDT}.. {-736372800 -18000 0 CST}.. {-144702000 -14400 1 CDT}.. {-134251200 -18000 0 CST}.. {-113425200 -14400 1 CDT}.. {-102542400 -18000 0 CST}.. {-86295600 -14400 1 CDT}.. {-72907200 -18000 0 CST}.. {-54154800 -14400 1 CDT}.. {-41457600 -18000 0 CST}.. {-21495600 -14400 1 CDT}.. {-5774400 -18000 0 CST}.. {9954000 -14400 1 CDT}.. {25675200 -18000 0 CST}.. {41403600 -14400 1 CDT}.. {57729600 -18000 0 CST}.. {73458000 -14400 1 CD

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Hermosillo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):616
                                                                                                                                                                                                                                                Entropy (8bit):4.351214377567366
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290e2mdH5NCtXwl3UXmMMmxL+voudQCvX70qKOV9kYNv:5Ie5k9WUQwuz/Vyu
                                                                                                                                                                                                                                                MD5:E35A6C6E9DCF0CA34BFA2993CE445D6C
                                                                                                                                                                                                                                                SHA1:4FF9C7EDBC73B1AE0815661571B7199379AF479C
                                                                                                                                                                                                                                                SHA-256:C0A87DC3A474D25083F0CEA0C323D8E780D937453CAD23C98AF367D81AC2CA2D
                                                                                                                                                                                                                                                SHA-512:56A728ABCD3EA91D2492E1331B3F76F31EF5675BCD95A692F9D94F91518B72569FD8DF1BB0515668E8A9BE0347018B391C65761D316903CA27C59883BBE0DE80
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Hermosillo) {.. {-9223372036854775808 -26632 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 1 MDT}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {915174000 -25200 0 MST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Indianapolis

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7230
                                                                                                                                                                                                                                                Entropy (8bit):3.882344472808608
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:nys0KHK1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:nyBKHkN0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:7824B3F2D20F16A9DCC8E0F7DC45C1B8
                                                                                                                                                                                                                                                SHA1:77014A0502DA1342EFA41B64C5613839B627354B
                                                                                                                                                                                                                                                SHA-256:4B114545167326F066AB3A798180896B43AC6FDC3B80D32BCC917B5A4A2359EB
                                                                                                                                                                                                                                                SHA-512:03F6A18C03E79E9177D16CD7AB75AC117197638370FA675BC2854A5A563021F865F3F0672B237B83098787AB9D419AC33D67F28324B1E25AD8560B5838F70807
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Indianapolis) {.. {-9223372036854775808 -20678 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-900259200 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Knox

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8755
                                                                                                                                                                                                                                                Entropy (8bit):3.8394539560522585
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:+q2KeNrdJ8SvAgahLi8hDlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:+FKUdJ8SvPaUqbA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:8AF080A022DA0737E94742C50EAAC62E
                                                                                                                                                                                                                                                SHA1:704F0565B53AA8A20F70B79A7958D4D07085E07A
                                                                                                                                                                                                                                                SHA-256:F1253F5F3F5AACD1A5E1F4636DD4E083F4B2A8BD995CF3E684CDD384641849F1
                                                                                                                                                                                                                                                SHA-512:26AAF6D24B2E2B60451E19A514533DFAEC74F01F9B1AEB9F86690669C14130D77AE1CBFB9FC9091E1CD1FC1CBC2799BB05026DB68768C3CCB960355C18D111ED
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Knox) {.. {-9223372036854775808 -20790 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-725824800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-447267600 -21600 0 CST}.. {-431539200 -18000 1 CDT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Marengo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7273
                                                                                                                                                                                                                                                Entropy (8bit):3.8700915866109535
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:7qvrv7+X1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7Kv7+bN0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:C1A10440E6CCE4C5052E2510182D9AA7
                                                                                                                                                                                                                                                SHA1:56D4F3CCA1245D626BADA74CF3F6BAE8034BF58D
                                                                                                                                                                                                                                                SHA-256:675162381639598E7100E90663D42780F8EE1CB62BD6DA5B948B494F98C02FE3
                                                                                                                                                                                                                                                SHA-512:96B71472AD38ECFC589F935D9F5F1C8D42C8E942D8772FB6A77F9B9C0E2BD7A07FA61729E57EC02356121518E33797A784679F8DED2FCA3FC79F5C114783DD57
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Marengo) {.. {-9223372036854775808 -20723 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-599594400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Petersburg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7611
                                                                                                                                                                                                                                                Entropy (8bit):3.87971256165061
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:TqervJ8SUklggahyBRP0HY2iU7KKdFL6Aa2K4gSLf8e:TpvJ8SUklvaQN0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:A86042668CD478AFFC05D3383EDEE8FF
                                                                                                                                                                                                                                                SHA1:6476526F94A247C0ECF3B2813F2C5A4FB93E457E
                                                                                                                                                                                                                                                SHA-256:23B8FA75CE0A9555DFD84549723A12679FF7FC5FAA58E4B745BA3C547071FF53
                                                                                                                                                                                                                                                SHA-512:07A5487A087108E6D6E88580865885CA6243EF04BE8263FC913F38CADB8EA016386E8BBAD39F65FD081F1A2F14316FEAF008855E9CF2019B169D9511916AFF67
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Petersburg) {.. {-9223372036854775808 -20947 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-473364000 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 1 CD

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Tell_City

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7100
                                                                                                                                                                                                                                                Entropy (8bit):3.8613085681914607
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:yqxrvJ8SUklLgzNA604qSScBgN+4ctDzIVQ/c/3hNxTh:yUvJ8SUkl8BA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:E7FE9B7CFBC6505C446056967DEBC87B
                                                                                                                                                                                                                                                SHA1:81ADAD89F040F62E87D2F26D1D98B3E52710F695
                                                                                                                                                                                                                                                SHA-256:D368123DB703B55244700876906775837D408C274C5A5801D80B77EADB6D5853
                                                                                                                                                                                                                                                SHA-512:9C0746DE18C80B548AA443D59BB9971BDC304975717C5FCDEBDE72828ACF408FA1D687F87C42E7B8D6D0284C9F792EA236BF79C815947BE773D07364B630AC99
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Tell_City) {.. {-9223372036854775808 -20823 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 0 EST

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Vevay

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6563
                                                                                                                                                                                                                                                Entropy (8bit):3.866646181493734
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:juqv01BRP0HY2iU7KKdFL6Aa2K4gSLf8e:CoKN0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:2CCFC3980C321ED8A852759C0BCCB12C
                                                                                                                                                                                                                                                SHA1:A8BFE02E4E71B28EF8E284E808F6EDE7C231F8FF
                                                                                                                                                                                                                                                SHA-256:0623233AA39A1A82038A56DF255ADF49E648777375B8499491C8897EBEA1CDF1
                                                                                                                                                                                                                                                SHA-512:A4C77689BC9BF871C756D05BAC4157F0FD324D10AC7D15F3543344C6F8C7FC9218AB7ADFBCE70C8ECCDD6EC15FD7960503FC7A8223FECE6D4227BF0BB04190C7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vevay) {.. {-9223372036854775808 -20416 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-495043200 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {1136091600 -18000 0 EST}.. {1143961200 -14400 1 EDT}.. {1162101600 -18000 0 EST}.. {1173596400 -14400 1 EDT}.. {1194156000 -18000 0 EST}.. {1205046000 -14400 1 EDT}.. {1225605600 -18000 0 EST}.. {1236495600 -14400 1 EDT}.. {1257055200 -18000 0 EST}.. {1268550000 -144

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Vincennes

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7226
                                                                                                                                                                                                                                                Entropy (8bit):3.879195938909716
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:Vq8rdJ5UklpRBRP0HY2iU7KKdFL6Aa2K4gSLf8e:VbdJ5Uklp/N0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:56D1930F5FAE2456DEC6C9AB1B0233E1
                                                                                                                                                                                                                                                SHA1:F6ED52EF769DF2C015C181BCFF3DC0E24497C768
                                                                                                                                                                                                                                                SHA-256:B8452B6AA739A78AC6D03806463B03D4175639593E19FAA3CA4B0D0FB77F18C9
                                                                                                                                                                                                                                                SHA-512:AFCFF383DB441DA9154B639A88700D0604F487A20E830146B14061E485A991AD8DC279AF8C0C2329265CF14C901207B9058157FAA1C039082EB7630916834156
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vincennes) {.. {-9223372036854775808 -21007 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-289414800 -21600 0 CST}.. {-273686400 -18000 1 CDT

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indiana\Winamac

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7410
                                                                                                                                                                                                                                                Entropy (8bit):3.8775722319777968
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:uq0KeKrv7c1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:unKxv7yN0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:880526DC23E7BDB00506D7EC2A885907
                                                                                                                                                                                                                                                SHA1:DB3B13A2A4BF80E7B71C7F0604A0A80EF070B9BA
                                                                                                                                                                                                                                                SHA-256:4B293FDB7680C4597B8C885333719214492ECF09BD5EA342D1EC15F2BF9C8605
                                                                                                                                                                                                                                                SHA-512:42EEDC5EA28781D62A457F4843F38D0A3FEFCAD83BA01B07CEF0FA169C6440960E04BABD272C5E9AF2F4B0DBB2A786EF9221A48F084F16752E6D0EA66C31911E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Winamac) {.. {-9223372036854775808 -20785 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Indianapolis

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):233
                                                                                                                                                                                                                                                Entropy (8bit):4.7047837427916095
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/2903GfJ4903GK8:MByMY3GK7Kp3GKnt2903GfJ4903GK8
                                                                                                                                                                                                                                                MD5:DEE404D54FD707C4A27F464B5F19D135
                                                                                                                                                                                                                                                SHA1:AD95D04738F6B15A93DED1DE6B5FA9F47C8E38CB
                                                                                                                                                                                                                                                SHA-256:437DA148B94DBA4CEA402169878541DB9C3419ABAB6750D1C36625DD3053019E
                                                                                                                                                                                                                                                SHA-512:421D6AF30F0C64EA6CB9F9DC4E7EF9E8EE5945F81A5E82A6D959D32AD69F325770DB6A07D8F52EFE7EE7F6C3AD4E1F34AA30A6B5E006C928119A54E746D6FE6B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Inuvik

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7638
                                                                                                                                                                                                                                                Entropy (8bit):3.8629745113156004
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:/nGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/GPlLv/PCenJzS6cy
                                                                                                                                                                                                                                                MD5:DBF9C2CCF786A593C9D6E4F4BB37ACE9
                                                                                                                                                                                                                                                SHA1:4D2332A530A36E6DB2802DD9FA2DAF5C0594D5EA
                                                                                                                                                                                                                                                SHA-256:5A1F7F5EDAD0251B73C33E7B5DDEE194646E9D3992B169DC1A64D155765D472C
                                                                                                                                                                                                                                                SHA-512:70D75371497CED3B6C731C95299CDD5F8F49C3C6EEDDF31EB05D008769D76ACFE8BFA9A2ECE45BD0BA2E279BBEF65945955791EFC04A569F5CAA13665CD2545F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Inuvik) {.. {-9223372036854775808 0 0 -00}.. {-536457600 -28800 0 PST}.. {-147888000 -21600 1 PDDT}.. {-131558400 -28800 0 PST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}.. {688550400 -25200 0 MST}.. {702464400 -21600 1 MDT}.. {7200000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Iqaluit

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7671
                                                                                                                                                                                                                                                Entropy (8bit):3.832645570123566
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:7FE5Ct/cQ1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7FEct/N0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:8020712BBA127EA8AB52E8F5DB14286E
                                                                                                                                                                                                                                                SHA1:DAEBC76FE10770D3FC2B5E1C14823B2B5543BA35
                                                                                                                                                                                                                                                SHA-256:AFC4627879F4A618F5E3BA9EA123F3212E161F4CCFD0DF46F3B6B7CD2E2C0D7E
                                                                                                                                                                                                                                                SHA-512:2F5C63F427A5DEDD5BF2B3867BE4C13774E9276C1472BF4170BCB2DA462B848CC8088743D032765133EE138388DF4217E4FC1475B12D2C8AF657A45ED6FEDE93
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Iqaluit) {.. {-9223372036854775808 0 0 -00}.. {-865296000 -14400 0 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-147898800 -10800 1 EDDT}.. {-131569200 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {7024

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Jamaica

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):847
                                                                                                                                                                                                                                                Entropy (8bit):4.206296468996689
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5seRvZGjFS/uk1p/uue/udYR/u+zN5hi/uW9/uoUF0/u8Bb/u33RU/uMZ8/unuR3:5jUjFo1pFGzfAYFqB43RMER3
                                                                                                                                                                                                                                                MD5:95B59E3EA2A270A34BDF98AA899203C8
                                                                                                                                                                                                                                                SHA1:93599597797F4BAFE5C75179FB795058B1E3527D
                                                                                                                                                                                                                                                SHA-256:4B9D5177CBA057CD53D53120A49B8A47ECCB00150018581A84851E9D5437D643
                                                                                                                                                                                                                                                SHA-512:032BC07F9E92B756A0732AECC2DFEC4C89A58B3D6D3CA57A0F99F2AD1D51676804C7B6CE50EB3B37BB8A1EF382168AC83989D609D37C57308E29B51F1FDEFB1E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Jamaica) {.. {-9223372036854775808 -18430 0 LMT}.. {-2524503170 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {126248400 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {441781200 -18000 0 EST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Jujuy

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):211
                                                                                                                                                                                                                                                Entropy (8bit):4.94277888588308
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7/MI6HAIgp/MIwRN/290pPGe90/MIz:MByMY/Myp/M9Rt290h390/M4
                                                                                                                                                                                                                                                MD5:E020D4F9CB1AF91D373CD9F3C2247428
                                                                                                                                                                                                                                                SHA1:0ADF2E9F8D9F8641E066764BA1BAF068F0332CE9
                                                                                                                                                                                                                                                SHA-256:4A0495852CD4D0652B82FB57024645916DB8F192EEF9A82AFD580D87F4D496ED
                                                                                                                                                                                                                                                SHA-512:03190F0E7EC35A358670B1617CB5C17EA3DD41195B2C4B748479D80ABAB4DB395293F688D94B87662D0469F6C5885CF7E7C9A995493A191905753F740DF659E1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Jujuy)]} {.. LoadTimeZoneFile America/Argentina/Jujuy..}..set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Juneau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8682
                                                                                                                                                                                                                                                Entropy (8bit):3.9620285142779728
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:/fCG0rHPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:/aG0rq9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                                                                                MD5:8160A0D27EECEF40F6F34A06D5D02BE6
                                                                                                                                                                                                                                                SHA1:7CAA64F83BAA0C23EE05A72BB1079AA552FA2F3D
                                                                                                                                                                                                                                                SHA-256:5FBE6A1FA2D3DFE23C7378E425F32BEBCA44735DA25EA075A7E5CE24BFD4049D
                                                                                                                                                                                                                                                SHA-512:59B8D04595007B45E582E6D17734999074CA67A93F5DF742EFE1EB78DB8ABD359D4C3B213B678C6A46040A13AAB709A994B6A532D720D3EF6FCA2730ABF4885E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Juneau) {.. {-9223372036854775808 54139 0 LMT}.. {-3225223727 -32261 0 LMT}.. {-2188954939 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {309949

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Kentucky\Louisville

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9553
                                                                                                                                                                                                                                                Entropy (8bit):3.853353361425414
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:tfTwKdrdJ9+StCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tfUKNdJ9+SItON0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:D721B38F1FFF1A6F5C02B72ECC06CDE5
                                                                                                                                                                                                                                                SHA1:E70D99A9FC1DA9F30389129EE00FE20FA79D66A8
                                                                                                                                                                                                                                                SHA-256:9EB1F2B19C44A55D6CC9FD1465BAF6535856941C067831E4B5E0494665014BF5
                                                                                                                                                                                                                                                SHA-512:3C82A8C27026228F359FD96A4306F1BC337DE655FD1BA02C4399162E44DE59AD58CE569DA5AEA36E586C3BDEE7256420AABB84B44D277E244FE5AD771B4BE307
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Louisville) {.. {-9223372036854775808 -20582 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1546279200 -21600 0 CST}.. {-1535904000 -18000 1 CDT}.. {-1525280400 -21600 0 CST}.. {-905097600 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747251940 -18000 1 CDT}.. {-744224400 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Kentucky\Monticello

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8558
                                                                                                                                                                                                                                                Entropy (8bit):3.869494272122571
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:4F8qMahLi8hR1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:4F8HaUqJN0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:AED6497590DA305D16AC034979C8B1E9
                                                                                                                                                                                                                                                SHA1:AD6F1788310A3A5A761873FEF1A32416B7DBCA89
                                                                                                                                                                                                                                                SHA-256:1C6C7FB0AE628EB6BB305B51859C4E5594A6B0876C386ED9C1C3355E7CB37AE1
                                                                                                                                                                                                                                                SHA-512:58D960AB5F2D9F8E4DD0171E5E36CE2E072F74A7AFDBC43F9340BBCF0CDC0D060AC895F9FCF551F4CC7EB6DBF2E9835C8C3D58E87CA4FBC98C720F51C462EDCD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Monticello) {.. {-9223372036854775808 -20364 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-63136800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Knox_IN

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.8670778268802195
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y73GKaHAIgp3GKIN/2901iZ903GKT:MByMY3GKDp3GKIt290Q903GKT
                                                                                                                                                                                                                                                MD5:50434016470AC512A8E2BEBA0BCEBC15
                                                                                                                                                                                                                                                SHA1:F3541F6EE201FA33C66042F5C11A26434D37D42C
                                                                                                                                                                                                                                                SHA-256:D66E77E6FF789D4D6CA13CDB204B977E1FE64BE9AFEE7B41F2C17ED8217FD025
                                                                                                                                                                                                                                                SHA-512:EB1FF97050B7E067DCB68FF7C8F912C8A0C02144BB8E2EAA58C1136C6CC4A2B98C897DD23BB1E9C82D9AF6D028EE45227F97676CB34B6B830CDF5D707B990E57
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Knox)]} {.. LoadTimeZoneFile America/Indiana/Knox..}..set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Kralendijk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.9362668992592456
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2901Qv090ppv:MByMYbpwt290ev090b
                                                                                                                                                                                                                                                MD5:FE9CEC6C50DF451B599B98AE8A434FF7
                                                                                                                                                                                                                                                SHA1:60F997825766662B2C5415FBE4D65CEA6D326537
                                                                                                                                                                                                                                                SHA-256:5AF9B28C48661FDC81762D249B716BA077F0A40ECF431D34A893BB7EABA57965
                                                                                                                                                                                                                                                SHA-512:1311605021871BAFAF321AA48B352262C6BA42149101CCD4FDD4000435B2584AC564E0F76D481BB181767C010FD922BAA4E4EBB401AC2FF27B21874D89332872
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Kralendijk) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\La_Paz

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):218
                                                                                                                                                                                                                                                Entropy (8bit):4.902526230255025
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/290WDm2OHphvoHvKZdcyFXmBVVON:MB86290ymdHphvCvKfcyy/ON
                                                                                                                                                                                                                                                MD5:3BC04900A19D0152A31B353C6715A97B
                                                                                                                                                                                                                                                SHA1:58A6D49E0B6FA00CBEAFD695D604D740AD63C54E
                                                                                                                                                                                                                                                SHA-256:5488D98AA3C29D710C6AF92C42ACE36550A5BFF78C155CDF8769EE31F71CF033
                                                                                                                                                                                                                                                SHA-512:65302935090F98A81443A1E1158911F57C3A1564564CD401CA72DDBF66D967DB564EF5AE8A4083D83984B9EF55AB53159010EFE2DB5D7A723F7EA61A1795322D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/La_Paz) {.. {-9223372036854775808 -16356 0 LMT}.. {-2524505244 -16356 0 CMT}.. {-1205954844 -12756 1 BST}.. {-1192307244 -14400 0 -04}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Lima

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):460
                                                                                                                                                                                                                                                Entropy (8bit):4.2444415392593875
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290B2mdH4VCvvCOt/Os/OCQXR/uFfC3/O3e/uFbs/OX/OqF/O+8/OOS1F5/D:59etvqOVLOR/uGD/utsg38xSP5r
                                                                                                                                                                                                                                                MD5:5F41E848D2DDE91261F45CB577B1B0A9
                                                                                                                                                                                                                                                SHA1:DF284499CF57479ADE5E1D3DC01D6DCCF6AFDFE1
                                                                                                                                                                                                                                                SHA-256:6E01002F264DF9A6FC247F95399F4F42DCCC7AB890B0C259DE93DCC97DEC89CE
                                                                                                                                                                                                                                                SHA-512:2F5472F812734E892182632B8A34A4AD7B342541D0C3F1107BD95FFBE25D9351A0CDF5F58F35A1F37365DDF8A8A5D883C89C3CC40A9AD09D54CA152DC6BE1A09
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Lima) {.. {-9223372036854775808 -18492 0 LMT}.. {-2524503108 -18516 0 LMT}.. {-1938538284 -14400 0 -05}.. {-1002052800 -18000 0 -05}.. {-986756400 -14400 1 -05}.. {-971035200 -18000 0 -05}.. {-955306800 -14400 1 -05}.. {-939585600 -18000 0 -05}.. {512712000 -18000 0 -05}.. {544248000 -18000 0 -05}.. {638942400 -18000 0 -05}.. {765172800 -18000 0 -05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Los_Angeles

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9726
                                                                                                                                                                                                                                                Entropy (8bit):3.8515163794355916
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:/uX68CWSgG0U9bFzN6IkWq/WHQt/RY4yP:/uX68CWSgGVbGBt/M
                                                                                                                                                                                                                                                MD5:4D4F198238E4E76753411896239041C3
                                                                                                                                                                                                                                                SHA1:AD41D199DF0B794B5AB7F165C8A141787FAAC9A9
                                                                                                                                                                                                                                                SHA-256:DA3F7572F04E6AE78B8F044761E6F48D37EE259A9C1FE15A67072CC64A299FDB
                                                                                                                                                                                                                                                SHA-512:BA39D174B73B1D4B09E8AC07291BED0B9658A4330AE50881080F0E37C35BD8A6F55C49F1D649ED1F19CE47002435D8724048759DFC813BF9C2E9B06B581486FF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Los_Angeles) {.. {-9223372036854775808 -28378 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-687967140 -25200 1 PDT}.. {-662655600 -28800 0 PST}.. {-620838000 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589388400 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557938800 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526489200 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Louisville

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):228
                                                                                                                                                                                                                                                Entropy (8bit):4.911677030377383
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y71PiKp4o2HAIgp1PiKp4BvN/290hp4901PiKp44v:MByMYPyApPydt290P490Pyi
                                                                                                                                                                                                                                                MD5:ACE87B25FE5604C83127A9F148A34C8C
                                                                                                                                                                                                                                                SHA1:25C8D85B4740C53F40421D0DADCA95225EAB7829
                                                                                                                                                                                                                                                SHA-256:F85C1253F4C1D3E85757D3DEA4FD3C61F1AA7BE6BAAE8CB8579278412905ACB2
                                                                                                                                                                                                                                                SHA-512:AC0662B19F336474B146E06778E1FB43B941ABC8FD51BDB31B2640C94CCDFBE7659960EF4FD18329AFA7AD11316FC08D3CF33BB27931EA70AA7218667A8D0737
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Kentucky/Louisville)]} {.. LoadTimeZoneFile America/Kentucky/Louisville..}..set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Lower_Princes

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):207
                                                                                                                                                                                                                                                Entropy (8bit):4.900350318979456
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290h48h490ppv:MByMYbpwt290/490b
                                                                                                                                                                                                                                                MD5:83CE86174ADB5F276AABD26FE132BB55
                                                                                                                                                                                                                                                SHA1:925E3F4A5DB1A2C33B3A537C8DBC9CFE309FA340
                                                                                                                                                                                                                                                SHA-256:1E786229B84CE86DB6316B24C85F7CF4CFE66011F973053AD0E108BFCC9A9DE2
                                                                                                                                                                                                                                                SHA-512:BA2AC5571D772B577735BC8E43FF8023228BC61A974DCCE0EAE20EC9B11FC757E56CABDAE00933A99834108114E598B7EC149BB017EB80BE18301A655F341A36
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Lower_Princes) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Maceio

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1539
                                                                                                                                                                                                                                                Entropy (8bit):3.7453889877550512
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5QChlvEw6kSSx5H4a8tf3fkuoLdNYVZDNR8nd:OIlvEwJSSxdF8tfMuoLdNYVZJR8nd
                                                                                                                                                                                                                                                MD5:EB0EDF4E075E3CF9F8EDF2B689C2FE54
                                                                                                                                                                                                                                                SHA1:9713D7E8AA0E7164824657D00DE6C49483D2BD19
                                                                                                                                                                                                                                                SHA-256:F65C5957D434A87324AAD35991E7666E426A20C40432540D9A3CB1EEE9141761
                                                                                                                                                                                                                                                SHA-512:0A0D1E4E0BD7D854E8F139E6F7A9BBC66422B73F7A6C2E1F1B6D2CA400B24B3D220AB519B6AEAA743443E9A4B748709CDF2C276BF52C5382669B12734A469125
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Maceio) {.. {-9223372036854775808 -8572 0 LMT}.. {-1767217028 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Managua

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):611
                                                                                                                                                                                                                                                Entropy (8bit):4.303621439025158
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290znTjmdHOYCvprv5EU/dLAyW+/uF+kX8/uF+RZ//dAWcP/QAWcx/uF+rbE:5GnPeOdvhxD1pLS+S8S+RVqzo4xS+3SJ
                                                                                                                                                                                                                                                MD5:FB09D1F064C30F9E223FA119A8875098
                                                                                                                                                                                                                                                SHA1:C66173FEB21761AEA649301D77FBB77ACF3A6FB1
                                                                                                                                                                                                                                                SHA-256:F0F0CCE8DE92D848A62B56EF48E01D763B80153C077230C435D464CF1733BA38
                                                                                                                                                                                                                                                SHA-512:BC3D841FF48FD0DE7C9ABF5DAE3A42C876BD4D7FBD6684B4513EC7ECC92D938A7133BCC873AD46E453DD1863E843E5C7DD14FFDB41B593E90BEB5CD8F7E66202
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Managua) {.. {-9223372036854775808 -20708 0 LMT}.. {-2524500892 -20712 0 MMT}.. {-1121105688 -21600 0 CST}.. {105084000 -18000 0 EST}.. {161758800 -21600 0 CST}.. {290584800 -18000 1 CDT}.. {299134800 -21600 0 CST}.. {322034400 -18000 1 CDT}.. {330584400 -21600 0 CST}.. {694260000 -18000 0 EST}.. {717310800 -21600 0 CST}.. {725868000 -18000 0 EST}.. {852094800 -21600 0 CST}.. {1113112800 -18000 1 CDT}.. {1128229200 -21600 0 CST}.. {1146384000 -18000 1 CDT}.. {1159682400 -21600 0 CST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Manaus

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1166
                                                                                                                                                                                                                                                Entropy (8bit):3.7842934576858482
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5GnqeKwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQz:5mSeSFESoSQSrSsCSeSPS1cSQSQlSsSQ
                                                                                                                                                                                                                                                MD5:E42719A9B0165490BB9E0E899EFB3643
                                                                                                                                                                                                                                                SHA1:2991D7EC31F47E32D2C8DB89A0F87D814122DD1B
                                                                                                                                                                                                                                                SHA-256:DC54E6D4FE14458B0462FA0E15B960FD4290930ADC0D13453BF49B436ED8C143
                                                                                                                                                                                                                                                SHA-512:F75024E27A2D679A667EA70EC948F983C7B823FDA5962DD88697D61147A6C2B1499E58BA8B01170653C4D025900491AE8E21925500DE39EACBAF883F7E62D874
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Manaus) {.. {-9223372036854775808 -14404 0 LMT}.. {-1767211196 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Marigot

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.900738604616686
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290zzJ/90ppv:MByMYbpwt290zzN90b
                                                                                                                                                                                                                                                MD5:8C60DE8E522FE5D51EACD643FD8EA132
                                                                                                                                                                                                                                                SHA1:2E09A71DF340ECA6F7AEBD978070D56A627049EC
                                                                                                                                                                                                                                                SHA-256:5C26D7CE93F91CC4F5ED87E9388B1B180EF9D84681044FD23CC01A628A1284CA
                                                                                                                                                                                                                                                SHA-512:D2D522D041AFA638542F6FF00F5F40325E3F117C5035BA71F676B4956B054542C67A753055D17E2E2EEA925F13EACC0969D01EC18E40D274D8EA408F92777EA2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Marigot) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Martinique

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):251
                                                                                                                                                                                                                                                Entropy (8bit):4.849143012086458
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/290zlEDm2OHfueoHv9dMIqR5lRfT/VVFUFkmR/lAov:MB86290zimdHfnCv9dMIqR5lVb/uFkmD
                                                                                                                                                                                                                                                MD5:CFE10EE56115D3A5F44E047B3661D8ED
                                                                                                                                                                                                                                                SHA1:03F598CFC9AEDE2F588339B439B2361F2EBDE34F
                                                                                                                                                                                                                                                SHA-256:D411FB42798E93B106275EC0E054F8F3C4E9FB49431C656448739C7F20C46EDE
                                                                                                                                                                                                                                                SHA-512:25D6760FDF2F1B0DD91A41D29BDB7048FAE27A03F7B9D9C955ECF4C32E8402836D007B39FE62B93E7BEA017681A0C8AFC1C4CAFD823B0A6C41EDAF09DDF3435D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Martinique) {.. {-9223372036854775808 -14660 0 LMT}.. {-2524506940 -14660 0 FFMT}.. {-1851537340 -14400 0 AST}.. {323841600 -10800 1 ADT}.. {338958000 -14400 0 AST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Matamoros

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6745
                                                                                                                                                                                                                                                Entropy (8bit):3.8432520851585372
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:aD5NA604qSScBgN+4ctDzIVQ/c/3hNxTh:aDbA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:FC4A24AE95BA6E36285F09AB2FCEE56F
                                                                                                                                                                                                                                                SHA1:54ED1CD69247064B5EC775E907790D19E93A4626
                                                                                                                                                                                                                                                SHA-256:59C658CEA1BF5392A8F16295A09A74230EFB52EF7BF783E493E9A9C1799036F2
                                                                                                                                                                                                                                                SHA-512:2E8E65C487090DC8EE90F8575360A00E74C134CE34E83D4296E2CC32B773F9F0151F4049BFD1BEEAFE7B441E8684AF9FB50287E42FBD5182E4051D1FC39932E3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Matamoros) {.. {-9223372036854775808 -23400 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Mazatlan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2067
                                                                                                                                                                                                                                                Entropy (8bit):3.990817847620547
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5GtXed9WUQwuz/V/NF01YmM/parZ375+XiB+:5sNUIdFS1YrpaV5+yB+
                                                                                                                                                                                                                                                MD5:43467194416FCF6F0D67AD2456D78646
                                                                                                                                                                                                                                                SHA1:1FDF02EF7354D9DB71F545D32AE52D018E99D801
                                                                                                                                                                                                                                                SHA-256:8140084EA9D6A478C34A114D9E216DC05450ECBE4809B2CDA194B40452E2AA0F
                                                                                                                                                                                                                                                SHA-512:EB5CD3E95779391F096EE9A7B16920C6C9E8A90F38C7A3CBE2B0E123D088A127C5BBE21F5883DCDAD4FBB2410ED052EDE3D4F1E260483D97FEBB7BA7022874C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mazatlan) {.. {-9223372036854775808 -25540 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 1 MDT}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -2520

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Mendoza

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):219
                                                                                                                                                                                                                                                Entropy (8bit):4.812188311941308
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7/MeHAIgp/MSvYovN/290zpH+90/MX:MByMY/M/p/MSA6t290zpe90/MX
                                                                                                                                                                                                                                                MD5:2A3BFEEFBB684FB3B420A6B53B588BDC
                                                                                                                                                                                                                                                SHA1:CC5C0BB90D847CCBB45688A8DA460AD575D64617
                                                                                                                                                                                                                                                SHA-256:D6B308A1619F2DE450DACBFEF0E11B237DF7375A80C90899DD02B827688CB4B8
                                                                                                                                                                                                                                                SHA-512:4A35C80D3454E039383FFEB06DC84933B3201BE2487C42A448AF3DA5ABAEEB9882263C011CDD3194E121EC1C31FC80120BF7829F280A79996E376CFA828EE215
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Mendoza)]} {.. LoadTimeZoneFile America/Argentina/Mendoza..}..set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Menominee

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8410
                                                                                                                                                                                                                                                Entropy (8bit):3.8311875423131534
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:6quShLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:6lSUqtfA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:C74D31382279219F805D2B138C58FBF7
                                                                                                                                                                                                                                                SHA1:06E2FED0A3BDF62F3D390A4054B6A2D7C1863DD3
                                                                                                                                                                                                                                                SHA-256:B0863F8B66F0848020651B69E7997307D62209259AE653FDC1A0FAFC8E793068
                                                                                                                                                                                                                                                SHA-512:7B42CBDC119651E2B2EE8B8F934801D3147A8B72EE060A0D0EA1C0C12CA9ABD03F1A102A85BF8E7424B45620151CE107D16A9173F4AA7597EDB3109840C1B2AE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Menominee) {.. {-9223372036854775808 -21027 0 LMT}.. {-2659759773 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-116438400 -18000 1 CDT}.. {-100112400 -21600 0 CST}.. {-21484800 -18000 0 EST}.. {104914800 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -2160

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Merida

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1877
                                                                                                                                                                                                                                                Entropy (8bit):3.9636871490767147
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5bu36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5Lj:1qehpYtj
                                                                                                                                                                                                                                                MD5:34909341A29FF048D83B707D12A728A5
                                                                                                                                                                                                                                                SHA1:A4D4EC31681DB5F9DA899E20C6789D10827E6D86
                                                                                                                                                                                                                                                SHA-256:ADE65ADDEEA027D1BE70DC7C12513B61FDF36289021E66982D527C7FEE2A2D19
                                                                                                                                                                                                                                                SHA-512:57EED40425680CE2C05D961D3F21EE2E0D204E1FD6D3DB5F1EF7AC349AA269F9397D4E2121BD13BC3DE34205564FBE009CEEB5ADE4052EA742CBA15A91F5822B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Merida) {.. {-9223372036854775808 -21508 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {407653200 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Metlakatla

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6705
                                                                                                                                                                                                                                                Entropy (8bit):3.985641709481311
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:4DCG0haiaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:42G0IiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                                                                                MD5:4999FE49C1640402CB432BC1EB667479
                                                                                                                                                                                                                                                SHA1:2ED0044927A66856090793ED6E5FF634617C8C40
                                                                                                                                                                                                                                                SHA-256:2574831391092AD44D7B2806EEF30D59CE3BAE872111917DD39EC51EFDD62E5F
                                                                                                                                                                                                                                                SHA-512:39DE1D24037F3FFA3101BBAA885939074E596479F68013CDA9CE53A061EA704F63FB55C15B68B66B0E29E3F07ADC0BDC2D78A2D289277E75D2EF95F54988DB74
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Metlakatla) {.. {-9223372036854775808 54822 0 LMT}.. {-3225223727 -31578 0 LMT}.. {-2188955622 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {30

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Mexico_City

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2261
                                                                                                                                                                                                                                                Entropy (8bit):3.9546083289866267
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5CBUBUI+n36fELf5On9uhcinzPPoUlWQnH7eelN5Lh9LY5Lj:EB7qehpYtj
                                                                                                                                                                                                                                                MD5:7A67EA7FF5AC0E9B088298007A9370F4
                                                                                                                                                                                                                                                SHA1:531583F67E0C6ABA95B5A664A555BF40BF743CE8
                                                                                                                                                                                                                                                SHA-256:E83DB749E6AA87FD56829C2810D0F93A4194E3EE2CB0BDC12114B1EF55E92E96
                                                                                                                                                                                                                                                SHA-512:2C9035B415E36A769782FCFA15D79E5FEACA232439D1442407C8CD8C144EE9991030D9D58D2AD54CF6C0840BF78C81921B82BECBC74ABBD0DAC627F77772F52F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mexico_City) {.. {-9223372036854775808 -23796 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 1 MDT}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-975261600 -18000 1 CDT}.. {-963169200 -21600 0 CST}.. {-917114400 -18000 1 CDT}.. {-907354800 -21600 0 CST}.. {-821901600 -18000 1 CWT}.. {-810068400 -21600 0 CST}.. {-627501600 -18000 1 CDT}.. {-612990000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001836800 -21600 0 CST}.. {1014184800 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {10357020

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Miquelon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7080
                                                                                                                                                                                                                                                Entropy (8bit):3.5379714312244217
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:2UViR+iORv7bw1aW5AnMyxH5e+fHbxMfOp6D7bF8qMmqyiqV1mjZe7JhlgXY7FWN:02l5qJZS
                                                                                                                                                                                                                                                MD5:C68889AA813C399939FCFA54E9CE0DFB
                                                                                                                                                                                                                                                SHA1:F3D58D7BEFF2D1CB94FECE00C31FEF5BDF58C231
                                                                                                                                                                                                                                                SHA-256:1B131AC968F95652667BD7EB1F6D667C8F679B31270D82B4B4271E787386CCCA
                                                                                                                                                                                                                                                SHA-512:EBAF8210919E34668E9DDFCB546E5A62F35954957AAE956B6302BF296C7D4CF51E1B10FB13217CB3EEB430DAC246217EB4E9250CB4109C95D8A4367457D02771
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Miquelon) {.. {-9223372036854775808 -13480 0 LMT}.. {-1850328920 -14400 0 AST}.. {326001600 -10800 0 -03}.. {536468400 -10800 0 -02}.. {544597200 -7200 1 -02}.. {562132800 -10800 0 -02}.. {576046800 -7200 1 -02}.. {594187200 -10800 0 -02}.. {607496400 -7200 1 -02}.. {625636800 -10800 0 -02}.. {638946000 -7200 1 -02}.. {657086400 -10800 0 -02}.. {671000400 -7200 1 -02}.. {688536000 -10800 0 -02}.. {702450000 -7200 1 -02}.. {719985600 -10800 0 -02}.. {733899600 -7200 1 -02}.. {752040000 -10800 0 -02}.. {765349200 -7200 1 -02}.. {783489600 -10800 0 -02}.. {796798800 -7200 1 -02}.. {814939200 -10800 0 -02}.. {828853200 -7200 1 -02}.. {846388800 -10800 0 -02}.. {860302800 -7200 1 -02}.. {877838400 -10800 0 -02}.. {891752400 -7200 1 -02}.. {909288000 -10800 0 -02}.. {923202000 -7200 1 -02}.. {941342400 -10800 0 -02}.. {954651600 -7200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Moncton

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10507
                                                                                                                                                                                                                                                Entropy (8bit):3.8204583916930557
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:X9+FPHyXFRsivcQYM+T7Z/xVQzxmtBWIXrObx29x8sLxcGMe++wzlrfFjxKvnpNM:gF6L0d0F2TzNc/1cYUH+CC
                                                                                                                                                                                                                                                MD5:80B88F57B837CD2478815796618A6AC6
                                                                                                                                                                                                                                                SHA1:CC2BE0213E9F0D3B307A8311D7A1013582E8A338
                                                                                                                                                                                                                                                SHA-256:D977D045DE5CDAEB41189B91963E03EF845CA4B45E496649B4CB541EE1B5DD22
                                                                                                                                                                                                                                                SHA-512:9410CBD706CAABFFF88DFF75235597D844B45A061EBD796F6708D7CEAB680273571A17935B7CCFC7C466ABF293C286D0886F47880E692F74C4E8BFB41729C73C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Moncton) {.. {-9223372036854775808 -15548 0 LMT}.. {-2715882052 -18000 0 EST}.. {-2131642800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1167595200 -14400 0 AST}.. {-1153681200 -10800 1 ADT}.. {-1145822400 -14400 0 AST}.. {-1122231600 -10800 1 ADT}.. {-1114372800 -14400 0 AST}.. {-1090782000 -10800 1 ADT}.. {-1082923200 -14400 0 AST}.. {-1059332400 -10800 1 ADT}.. {-1051473600 -14400 0 AST}.. {-1027882800 -10800 1 ADT}.. {-1020024000 -14400 0 AST}.. {-996433200 -10800 1 ADT}.. {-988574400 -14400 0 AST}.. {-965674800 -10800 1 ADT}.. {-955396800 -14400 0 AST}.. {-934743600 -10800 1 ADT}.. {-923947200 -14400 0 AST}.. {-904503600 -10800 1 ADT}.. {-891892800 -14400 0 AST}.. {-883598400 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Monterrey

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1940
                                                                                                                                                                                                                                                Entropy (8bit):3.9628147491173964
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5JZKy36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5Lj:XwDqehpYtj
                                                                                                                                                                                                                                                MD5:4AE2B33D9DACE0E582FA456B361C50B7
                                                                                                                                                                                                                                                SHA1:5D62287F072F3687EF130BB1A9DD97BB2ABCF91C
                                                                                                                                                                                                                                                SHA-256:F5A66A403BF40BE7EAB188F3CEC8D7DB700F60084F7B856AB87E0AA4A0F2C0B6
                                                                                                                                                                                                                                                SHA-512:39BE803FD47709A1120FC8E09DB9B294DE41F69C7DD86AAB03AD8D0878B160B21D82B16398125559B792DAE99D5D917AE466C536001FEC1E618B68ACA9A80322
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Monterrey) {.. {-9223372036854775808 -24076 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Montevideo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2936
                                                                                                                                                                                                                                                Entropy (8bit):3.6410670126139046
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5JgQkS4SaEcSyS0sZSUS2kSVSXSulSASX5kAXJMsCXrUari3akaWCa3M+lafpI6L:X5kH4c9GT0E01jm5keJMRXrUEi3akaWO
                                                                                                                                                                                                                                                MD5:D78DEBC7C0B15B31635DDC34C49248BC
                                                                                                                                                                                                                                                SHA1:DB2FF76DB3A79BE52E2DFD4C7B8B6592946772F9
                                                                                                                                                                                                                                                SHA-256:214F97A3BCB2378CCE23D280EA6A3B691604F82E383628F666BE585BB8494932
                                                                                                                                                                                                                                                SHA-512:E5FCD0B54F61910E70B1D0EE9911C5B4AFF850F16B651A01D69A63A97880913B0BAB99B0D864C4E613594734FA72CCA0E9607B1ADB6E75957C790990114FD0A4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Montevideo) {.. {-9223372036854775808 -13491 0 LMT}.. {-1942690509 -13491 0 MMT}.. {-1567455309 -14400 0 -04}.. {-1459627200 -10800 0 -0330}.. {-1443819600 -12600 0 -0330}.. {-1428006600 -10800 1 -0330}.. {-1412283600 -12600 0 -0330}.. {-1396470600 -10800 1 -0330}.. {-1380747600 -12600 0 -0330}.. {-1141590600 -10800 1 -0330}.. {-1128286800 -12600 0 -0330}.. {-1110141000 -10800 1 -0330}.. {-1096837200 -12600 0 -0330}.. {-1078691400 -10800 1 -0330}.. {-1065387600 -12600 0 -0330}.. {-1047241800 -10800 1 -0330}.. {-1033938000 -12600 0 -0330}.. {-1015187400 -10800 1 -0330}.. {-1002488400 -12600 0 -0330}.. {-983737800 -10800 1 -0330}.. {-971038800 -12600 0 -0330}.. {-954707400 -10800 1 -0330}.. {-938984400 -12600 0 -0330}.. {-920838600 -10800 1 -0330}.. {-907534800 -12600 0 -0330}.. {-896819400 -10800 1 -0330}.. {-853621200 -9000 0 -03}.. {-84

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Montreal

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.748877320903638
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEzQ21h4IAcH:SlSWB9vsM3y7RQtHAIgpRQPN/290zQgp
                                                                                                                                                                                                                                                MD5:9130CD86BD6417DB877BF9D8F3080CE1
                                                                                                                                                                                                                                                SHA1:76C37982C37FE54ED539AC14B5A513817E42937C
                                                                                                                                                                                                                                                SHA-256:97F48948EF5108FE1F42D548EA47C88D4B51BF1896EE92634C7ED55555B06DBD
                                                                                                                                                                                                                                                SHA-512:EE036350AF95414392BD93DFF528F67D9A93EB192A30056ECBC3D2396AB4B2938B3C096C3EC2BC739294D4C4B7261C427B0AAEB9559F5381CB7F375892781820
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Montreal) $TZData(:America/Toronto)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Montserrat

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.878534808314885
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290zQ1HK90ppv:MByMYbpwt290zQ490b
                                                                                                                                                                                                                                                MD5:CB5988A2508285B42C2BD487B8F9D6E1
                                                                                                                                                                                                                                                SHA1:EAD740A566245B682CE5E284D389DFAE66DF05D9
                                                                                                                                                                                                                                                SHA-256:6C3EE46983A3DAA91C9ADF4B18D6B4B80F1505B0057569B66D5B465D4C09B9C1
                                                                                                                                                                                                                                                SHA-512:48796213A67F0E3BC56B54CE4D8BE098E74BA5808C9A1082D9381CB729ADFA2ACB9CE9E39A3244B3901405761C97AEE28D44C3BF7239ECC71175C62E152029C4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Montserrat) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Nassau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.785765433607229
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEwEzEeIAcGu:SlSWB9vsM3y7RQtHAIgpRQPN/290xzEf
                                                                                                                                                                                                                                                MD5:F7DAD684104D917E0F29F6951EA627AC
                                                                                                                                                                                                                                                SHA1:E57B5CA730D90C5865CF32FEC4872F71E033D21C
                                                                                                                                                                                                                                                SHA-256:A889810B8BB42CD206D8F8961164AD03CCFBB1924D583075489F78AFA10EAF67
                                                                                                                                                                                                                                                SHA-512:8284F2A357A32B2F5A211904F65E3B5C37B77C9BF38C85DFA0A95A73457F3076EC12F09BC767B4D0B8FC86BF69D01A17A7BF685BAB72F3E519A397D050DA0C3B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Nassau) $TZData(:America/Toronto)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\New_York

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11373
                                                                                                                                                                                                                                                Entropy (8bit):3.8110553140357086
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:HeohzORhK1a8phYvNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:+uORhK1a8phYloSItON0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:385C3BDD3E41E5E75CEF0658322B5CDE
                                                                                                                                                                                                                                                SHA1:0334C21C8316ED2EE16FC98B1E8867D5E0916C00
                                                                                                                                                                                                                                                SHA-256:7BA7DA179AA7DF26AC25E7ACCD9BD83784174445285A0D9CCBD7D6A9AA34F4BC
                                                                                                                                                                                                                                                SHA-512:764B680FB8414B5AC8FB110247C19B1004A4453DD2BAC94BF3CFD80281FF3679A5B1D212238509165E022269503ED14A54B0EF73AF7014344752E6A627657D1F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/New_York) {.. {-9223372036854775808 -17762 0 LMT}.. {-2717650800 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-1577905200 -18000 0 EST}.. {-1570381200 -14400 1 EDT}.. {-1551636000 -18000 0 EST}.. {-1536512400 -14400 1 EDT}.. {-1523210400 -18000 0 EST}.. {-1504458000 -14400 1 EDT}.. {-1491760800 -18000 0 EST}.. {-1473008400 -14400 1 EDT}.. {-1459706400 -18000 0 EST}.. {-1441558800 -14400 1 EDT}.. {-1428256800 -18000 0 EST}.. {-1410109200 -14400 1 EDT}.. {-1396807200 -18000 0 EST}.. {-1378659600 -14400 1 EDT}.. {-1365357600 -18000 0 EST}.. {-1347210000 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-123895440

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Nipigon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.799414617322291
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEwMueh4IAcH:SlSWB9vsM3y7RQtHAIgpRQPN/2905u+p
                                                                                                                                                                                                                                                MD5:B01CC44E5139066F87ADFF16728B98BF
                                                                                                                                                                                                                                                SHA1:4464E187AFF336C9137094308C270BB822974DF1
                                                                                                                                                                                                                                                SHA-256:55C37BF1A579A22A790ADE6585CE95BEC02DA356E84D2EF7832C422A4484FF9D
                                                                                                                                                                                                                                                SHA-512:A45166FFE444982593CBAC3E683D25D9EDB070DB6CD059A83D1C52099F409FFBFE6EA68D255AD000AF142BF8C8D100271531852263677184597877B7BF318847
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Nipigon) $TZData(:America/Toronto)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Nome

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8680
                                                                                                                                                                                                                                                Entropy (8bit):3.965662913874442
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:OrBvOs5vzC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:OrBvOsM9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                                                                                MD5:9A5F536932FED5A93E2C3DEB81960CD1
                                                                                                                                                                                                                                                SHA1:8E78396D280DD3A9564CEFC7FB722437F3C4D003
                                                                                                                                                                                                                                                SHA-256:8E971C9560CCE548B46626D072E62AB0F4C9682BF6A6ABFB4D0E8D63745402FE
                                                                                                                                                                                                                                                SHA-512:60CFDBCE87F9CD7F27E071D66B97E60F62E56F413DC867BC809490B30D00045D0757710D6B5724148E2A28BD1E45FB662391820E6350D998002BF67B16776645
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nome) {.. {-9223372036854775808 46702 0 LMT}.. {-3225223727 -39698 0 LMT}.. {-2188947502 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Noronha

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1397
                                                                                                                                                                                                                                                Entropy (8bit):3.78056049136398
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5TenykFxCFbF3YCFE2FBCFDFr9CFaFPBCFoF2CFTFKCFDuF1CF2F1CFWFhCFGF3a:5quY9EmFYBosNZNW/bWsBzgCccq7JYN9
                                                                                                                                                                                                                                                MD5:B4F4530FCE4BF5690042A2DA40413D56
                                                                                                                                                                                                                                                SHA1:52D5F2102485F5B326C888A287ED83CA18833BBC
                                                                                                                                                                                                                                                SHA-256:9011C76295E6B17CC1973876B497BEE21B9E6562FB25DF66140F811A1FFA9765
                                                                                                                                                                                                                                                SHA-512:08CAF75226D190D9FF0AA62AD84B13F1BF9047338A690847DF5B448BDB731A877F3E186298AFD704F4F4E133FF3F3128B098F9D90AE9A8E726AE52F84A7DA2E3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Noronha) {.. {-9223372036854775808 -7780 0 LMT}.. {-1767217820 -7200 0 -02}.. {-1206961200 -3600 1 -02}.. {-1191366000 -7200 0 -02}.. {-1175378400 -3600 1 -02}.. {-1159830000 -7200 0 -02}.. {-633823200 -3600 1 -02}.. {-622072800 -7200 0 -02}.. {-602287200 -3600 1 -02}.. {-591836400 -7200 0 -02}.. {-570751200 -3600 1 -02}.. {-560214000 -7200 0 -02}.. {-539128800 -3600 1 -02}.. {-531356400 -7200 0 -02}.. {-191368800 -3600 1 -02}.. {-184201200 -7200 0 -02}.. {-155167200 -3600 1 -02}.. {-150073200 -7200 0 -02}.. {-128901600 -3600 1 -02}.. {-121129200 -7200 0 -02}.. {-99957600 -3600 1 -02}.. {-89593200 -7200 0 -02}.. {-68421600 -3600 1 -02}.. {-57970800 -7200 0 -02}.. {499744800 -3600 1 -02}.. {511232400 -7200 0 -02}.. {530589600 -3600 1 -02}.. {540262800 -7200 0 -02}.. {562125600 -3600 1 -02}.. {571194000 -7200 0 -02}.. {592970400 -

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\North_Dakota\Beulah

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8557
                                                                                                                                                                                                                                                Entropy (8bit):3.8810445182855253
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:WEktwmGaLV911sF9A604qSScBgN+4ctDzIVQ/c/3hNxTh:WBwDPPA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:10AF9E9461DD03DA4F0AF0595EB36E6C
                                                                                                                                                                                                                                                SHA1:57AC9BDE3AC665E49D9D2463A4BFA38C053A4A54
                                                                                                                                                                                                                                                SHA-256:D0D8B108453265B60F525A4EC04DE9555087CD6AC5DDBA980B3A96CF0FCD68D1
                                                                                                                                                                                                                                                SHA-512:B6DC7D2709A19B911E086C988DB8346F42DBF7601D9E51E3093C6AF897570E43E5F1C101FE88BC5251F3DCC3B532DB22FFE8A12A4D0151BC52AF3E6DDEA7D23A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Beulah) {.. {-9223372036854775808 -24427 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\North_Dakota\Center

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8557
                                                                                                                                                                                                                                                Entropy (8bit):3.867423227197841
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:ZEktwmGaLV9tZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:ZBwD6fA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:33C03AD65753D7ADB45FC4899B504D1A
                                                                                                                                                                                                                                                SHA1:ED719BB67A64DB49901BA38A945A6BA998646B8D
                                                                                                                                                                                                                                                SHA-256:ABC2B6C97D9E9FBA37AC582ADBA2CE996890D090060E083405D75CDAED9EABE0
                                                                                                                                                                                                                                                SHA-512:69592E8A370C8A5173827500CDDF8190AB44EA87CD7E0C416055CB7958B13A737801EA6B0FFE6032CB3F14F05001BF9DA83E4AEB20F385019B2985ECE7ACB40E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Center) {.. {-9223372036854775808 -24312 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\North_Dakota\New_Salem

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8560
                                                                                                                                                                                                                                                Entropy (8bit):3.879452555978431
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:GEktwmGaLV9nlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:GBwD2fA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:3D3DC12209293086FD843738A4FE87FB
                                                                                                                                                                                                                                                SHA1:8103DFA18B5F3F36AF0B53FA350E0F2D300E6289
                                                                                                                                                                                                                                                SHA-256:8803FF7C81C933B57178B9D3C502FB4268D9AA594A3C638A7F17AF60B12D300D
                                                                                                                                                                                                                                                SHA-512:39BB939780A71B817F82D2B7F56815D33926D150525161051A9950E5A98BA9184670AFC884A1C69D56EADBD6198E3082975448EFBA5FE8A336DB071E6BAB8EF2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/New_Salem) {.. {-9223372036854775808 -24339 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -2160

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Nuuk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7429
                                                                                                                                                                                                                                                Entropy (8bit):3.5470060859729253
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:0ixKXpbzvZ+FxAqe12voJ0euJFNgIHc/QEeF5Z1V8tCSfifK3facfzQWWLQelXuC:0LRJq9LstgV
                                                                                                                                                                                                                                                MD5:FC9CEA4B9654D0957F55CB0E1B25A3E7
                                                                                                                                                                                                                                                SHA1:8BFC3E8CEC34C4087579D3DA727143E3EC045B77
                                                                                                                                                                                                                                                SHA-256:12917DAAA60134BFE56E6979BB27B58A3F295C32BAE02B233E849BCED6B8BCA2
                                                                                                                                                                                                                                                SHA-512:355628F2EFF86605653A1EE7D976CE8B3229A4169D35576F6007FABAB37DD280D8F296EE88BECE3D84D3A1C476F23275D1D77CAF157E9A98672CBF14801D7292
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nuuk) {.. {-9223372036854775808 -12416 0 LMT}.. {-1686083584 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -7200 1 -0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Ojinaga

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2069
                                                                                                                                                                                                                                                Entropy (8bit):3.994692300159945
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5Pe89WU0S+VS+TjV/NF01YluO53ON4Lvf3Pn:5gU033FS1YluOQiLvf3Pn
                                                                                                                                                                                                                                                MD5:0CB80C895BB4BFD36043F1CAAFB604B7
                                                                                                                                                                                                                                                SHA1:2EC2CA1D31EF1804E4EC26F449CA0D3C4F7AA7A0
                                                                                                                                                                                                                                                SHA-256:FC857E4DD0A4AE60A7C56637C752205E20442C7AE62158435BEFCA838174108D
                                                                                                                                                                                                                                                SHA-512:4BE44FF49AC588F1B441AB1B2678F5A0F0B60DB5C69F3F45C7447FC5A0175146F9FF83E132A5256CF7E559809EF7394C23DF9156A295D84D3A67EE917E661EED
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Ojinaga) {.. {-9223372036854775808 -25060 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 1 MDT}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -21

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Panama

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.970379147398626
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2IAcGEu5YfMXGm2OHGf8xYoHv5BidhZvFsc1HRX1va0v:SlSWB9eg/290ZDm2OHDxYoHv5GhZd93p
                                                                                                                                                                                                                                                MD5:AA408A43079EC8933DE271BE3DA2B502
                                                                                                                                                                                                                                                SHA1:421A867DB3FD4779C5F759D0B657D8EB5FB2218B
                                                                                                                                                                                                                                                SHA-256:990213DDE00ADCEB74C8D1ECAF81B9C77963E4AB1F35767F7349236FC8E917DF
                                                                                                                                                                                                                                                SHA-512:1FB740527555A8E128E05709D05720A249BCBA4B6434D00226C07426E6283AA48973F75268F36E6044F0F0650E012781C8E5519B7EA916C625BBF018B29E9961
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Panama) {.. {-9223372036854775808 -19088 0 LMT}.. {-2524502512 -19176 0 CMT}.. {-1946918424 -18000 0 EST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Pangnirtung

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7736
                                                                                                                                                                                                                                                Entropy (8bit):3.8533019559841972
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:tTqPm4bPJWXtRbALtuO/N0HY2iUmUFLqU:Izod
                                                                                                                                                                                                                                                MD5:6BA298F9CEB6406802A01C13313F8EF1
                                                                                                                                                                                                                                                SHA1:D77C113CFA927EF65461781FD080F590C8CFCBB9
                                                                                                                                                                                                                                                SHA-256:1FB962ECC1E5F02E1001C70460FFF720B114554F9AA7956D6DA154DBEA87B4D7
                                                                                                                                                                                                                                                SHA-512:C7F4E2DA503A3167098CFAB7AEC8D75A32D6B081E6777DE7BA3D6B4558D0C44D2CD8A0F1626968295031BABFD2CB96B031B4C00A44F2C554B5B217AE67E69EB4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Pangnirtung) {.. {-9223372036854775808 0 0 -00}.. {-1546300800 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-147902400 -7200 1 ADDT}.. {-131572800 -14400 0 AST}.. {325663200 -10800 1 ADT}.. {341384400 -14400 0 AST}.. {357112800 -10800 1 ADT}.. {372834000 -14400 0 AST}.. {388562400 -10800 1 ADT}.. {404888400 -14400 0 AST}.. {420012000 -10800 1 ADT}.. {436338000 -14400 0 AST}.. {452066400 -10800 1 ADT}.. {467787600 -14400 0 AST}.. {483516000 -10800 1 ADT}.. {499237200 -14400 0 AST}.. {514965600 -10800 1 ADT}.. {530686800 -14400 0 AST}.. {544600800 -10800 1 ADT}.. {562136400 -14400 0 AST}.. {576050400 -10800 1 ADT}.. {594190800 -14400 0 AST}.. {607500000 -10800 1 ADT}.. {625640400 -14400 0 AST}.. {638949600 -10800 1 ADT}.. {657090000 -14400 0 AST}.. {671004000 -10800 1 ADT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Paramaribo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):253
                                                                                                                                                                                                                                                Entropy (8bit):4.784405839512086
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/290olofDm2OHekeoHXFIV/1Vw/9vVOzFZg/VVFAKV:MB86290oloLmdHeVCXqV/k/9v4zW/OW
                                                                                                                                                                                                                                                MD5:BFCE7E2618D6935031D6941AD6DDD8E3
                                                                                                                                                                                                                                                SHA1:1953CD224FB2363B10372C0476760F3FB020CB00
                                                                                                                                                                                                                                                SHA-256:B3EE44B3526BEDFC25B806371D3C465FDBD6CC647F30BF093750651E4A0C1BE4
                                                                                                                                                                                                                                                SHA-512:31262DF034E084DA4CDB57B99178594C29129F61F3535E5D8245B8BB4AB6BF314307B0F5E58B74C349684CD761C9CDE44EB10407FB135BA6427D3D1E9DA99B40
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Paramaribo) {.. {-9223372036854775808 -13240 0 LMT}.. {-1861906760 -13252 0 PMT}.. {-1104524348 -13236 0 PMT}.. {-765317964 -12600 0 -0330}.. {465449400 -10800 0 -03}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Phoenix

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):496
                                                                                                                                                                                                                                                Entropy (8bit):4.444598497301421
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290OXmdH514YCvb8o1W4S9xRvhhHRVxORBYUNv:5tekdvYP1x52yq
                                                                                                                                                                                                                                                MD5:062ECA57C0B795780240CD7AFE70BDA0
                                                                                                                                                                                                                                                SHA1:89D71A11DD8D4E000F7FADBDDC77C4C1DC1195F7
                                                                                                                                                                                                                                                SHA-256:DFA0EC91804B789A1A7E1B1977710435D2589A5B54C1579C8E1F5BF96D2FD007
                                                                                                                                                                                                                                                SHA-512:7D123AA872E0B8286A26E338AE0F8E0D7A6F0F2EA8B1EBEC6DBB59477C812985CB246AD397D0901A58FDB7FF14171CF60169DC15C538B95C58BD2D46106A7A4D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Phoenix) {.. {-9223372036854775808 -26898 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-820519140 -25200 0 MST}.. {-796841940 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-56221200 -25200 0 MST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Port-au-Prince

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6613
                                                                                                                                                                                                                                                Entropy (8bit):3.8549788442269395
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5Ux+E2p3T6ZqrNSMEBPMcywh4NF5zCC7IOTWa1HW1241UWK9BDL+3XC4BMrS2LxP:KOfS0HY2iU7KKdFL6Aa2K4gSLf8e
                                                                                                                                                                                                                                                MD5:A720323DF122C70C1530788DB24700BA
                                                                                                                                                                                                                                                SHA1:20674BD7D84CC686ABBB5D6B36B520A5E9C813ED
                                                                                                                                                                                                                                                SHA-256:A89C580899AD2FF8DF45A783BB90D501DC32C28B92931CA18ABD13453E76244B
                                                                                                                                                                                                                                                SHA-512:02B71E537B9FDAF1B68E381F0007CCBBA53EB70719ED38F51B56C5BFA64C7E3D9797053C9DE3A920E5CAFA09BBC062FCED62B5D6B9213AFA8286B95DEDAB0532
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Port-au-Prince) {.. {-9223372036854775808 -17360 0 LMT}.. {-2524504240 -17340 0 PPMT}.. {-1670483460 -18000 0 EST}.. {421218000 -14400 1 EDT}.. {436334400 -18000 0 EST}.. {452062800 -14400 1 EDT}.. {467784000 -18000 0 EST}.. {483512400 -14400 1 EDT}.. {499233600 -18000 0 EST}.. {514962000 -14400 1 EDT}.. {530683200 -18000 0 EST}.. {546411600 -14400 1 EDT}.. {562132800 -18000 0 EST}.. {576050400 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607500000 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638949600 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671004000 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {702453600 -14400 1 EDT}.. {719992800 -18000 0 EST}.. {733903200 -14400 1 EDT}.. {752047200 -18000 0 EST}.. {765352800 -14400 1 EDT}.. {783496800 -18000 0 EST}.. {796802400 -14400 1 EDT}.. {814946400 -18000 0 EST}.. {828856800 -14400 1 EDT}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Port_of_Spain

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):207
                                                                                                                                                                                                                                                Entropy (8bit):4.919510214047913
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290e7490ppv:MByMYbpwt290190b
                                                                                                                                                                                                                                                MD5:4AB394CB233B101627136EB5E070CF9B
                                                                                                                                                                                                                                                SHA1:F00600CD2DB10FE157C3696F665B9759EEA85F99
                                                                                                                                                                                                                                                SHA-256:A4952380C89A6903FFE5BF8707B94B1BB72568FFD03DB04BF4D98E38AC82EEB7
                                                                                                                                                                                                                                                SHA-512:58F4AD08FA10F1884FA641C4EA778C0FC013EABBD68DF5DE04D5B301227396260C3D669DB33DD6A6B33F1550C24BBD7777D756DF0D61CEEAF5EC6541EDFA296C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Port_of_Spain) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Porto_Acre

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.866417687745155
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7thteSHAIgpth9RN/290msh490th4:MByMYdIp7t290v490I
                                                                                                                                                                                                                                                MD5:6B570E79FA2AA7D6CB1E56A11EE0A37C
                                                                                                                                                                                                                                                SHA1:396A2C9BBE4F264DD5A4F2E44D3E63C57F52186B
                                                                                                                                                                                                                                                SHA-256:52921EEA2A1925DF06CEA4638ED4128FAAA8FBA40ED4E0741650B419E5152DCB
                                                                                                                                                                                                                                                SHA-512:FA75A179664BED02A0F5BC1B7C3DD5F3E986544A151634BA4C4401476F5999714C89E240D9AF805484D1BEC04A1A562157FAEECA1603C4FF8CFFB424B9DEB560
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Porto_Velho

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1051
                                                                                                                                                                                                                                                Entropy (8bit):3.851275104153641
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5Xe4QJnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/8:5kSeSFESoSQSrSsCSeSPS1cSQSQlSsSX
                                                                                                                                                                                                                                                MD5:03046BA6F8344C32AD7A22748DC871AB
                                                                                                                                                                                                                                                SHA1:AB9ED078D80AE99EF6DE4BF34AC45359B82D1284
                                                                                                                                                                                                                                                SHA-256:E6E6F6753E7D443052A64D4DB07B8D443CE13A573946E7D0A19CDD4BBA4A2F04
                                                                                                                                                                                                                                                SHA-512:620953BB4C8CF203262EC0C1F807543D24B9894C3B531AE57F7CEF630452CC9AC7CA41D43A6D8891F9CF17594E9EE34CF501F8508E7C0669A8E5EF9C70B6EAA3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Porto_Velho) {.. {-9223372036854775808 -15336 0 LMT}.. {-1767210264 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {5712012

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Puerto_Rico

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):283
                                                                                                                                                                                                                                                Entropy (8bit):4.781646667761219
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/290piDm2OH9VoHvMlFoeVVF70ZVVFUFkzk/lLJpR/lAov:MB862908mdHvCvMlGe/J0Z/uFkzk/lL1
                                                                                                                                                                                                                                                MD5:E2E2E0D6677FFF2E37BBFC3522F2A9AA
                                                                                                                                                                                                                                                SHA1:4C1C93E14FBC00B8B1E78B8D9631599164305EB1
                                                                                                                                                                                                                                                SHA-256:2981248A9F14EBFC8791EC5453170376CBD549557E495EA0E331CC18556C958E
                                                                                                                                                                                                                                                SHA-512:F056B03EB9945823F5284C840E06E298DD2DE854F1555CD16D0BB19D962B73EF34A05683E6369B0D89CB7C3F7D082C312CCA6F8C6A0BB53F5C75FE4A863FCD95
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Puerto_Rico) {.. {-9223372036854775808 -15865 0 LMT}.. {-2233035335 -14400 0 AST}.. {-873057600 -10800 0 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Punta_Arenas

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3729
                                                                                                                                                                                                                                                Entropy (8bit):3.6253057710886956
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:2RPW7xUQjzoMUBI0nuUoDKlHslPlgiot7JC/Xk8NWse4r4g5xCEmSdLkUsZOn+ZW:247xUQjzoMUBI0nuUoDK6lPlgiot7JCV
                                                                                                                                                                                                                                                MD5:D4ECD2A380E55A10FB97AB1D29C619F3
                                                                                                                                                                                                                                                SHA1:AAAFF44590F08623BE6F61EA6EFF6488C99A73BF
                                                                                                                                                                                                                                                SHA-256:4E626BD8B9182E56ADA1E9276585E945957431EA9BEA949CE071305E4E3C70A2
                                                                                                                                                                                                                                                SHA-512:677EE7093A53B48DE526C5877DB7128E8746831FE0DC44A38EB84050757E6017C9471EEF9AFCCEEEB5794D1608E486840804C01BD6276EA53F3C7823B05ED62B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Punta_Arenas) {.. {-9223372036854775808 -17020 0 LMT}.. {-2524504580 -16965 0 SMT}.. {-1892661435 -18000 0 -05}.. {-1688410800 -16965 0 SMT}.. {-1619205435 -14400 0 -04}.. {-1593806400 -16965 0 SMT}.. {-1335986235 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-736632000 -14400 1 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}.. {37767600 -14400 0 -04}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Rainy_River

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):196
                                                                                                                                                                                                                                                Entropy (8bit):4.926514352074701
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7pYHAIgppuRN/290ly90pl:MByMY/pcRt290w90X
                                                                                                                                                                                                                                                MD5:552FBD2FBAD42F79C7993124D9CCC54B
                                                                                                                                                                                                                                                SHA1:9029B7CCE8A5AD0F14C05FFBCDA4CA225DEC1708
                                                                                                                                                                                                                                                SHA-256:FEC74A3FCBD9B99FDFF24B54223DA187958697CBE756A54592F6171C69F1403F
                                                                                                                                                                                                                                                SHA-512:96315C32C1D0DEF804A560022DA12B3C63200A680F2A37D1B03E1C9EA413842EB6051E1C2315AE4E7C374280AD0E59832F834A8D6D66E259EF62735A77917ECE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Winnipeg)]} {.. LoadTimeZoneFile America/Winnipeg..}..set TZData(:America/Rainy_River) $TZData(:America/Winnipeg)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Rankin_Inlet

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7614
                                                                                                                                                                                                                                                Entropy (8bit):3.8349162993762267
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:Wi8h4ZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:bqOfA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:793DAEDB7E3077DE52DCC3C8A7CBEC5B
                                                                                                                                                                                                                                                SHA1:37562E9F28D51DED41FFD5FF2FF19E2E4E453B7A
                                                                                                                                                                                                                                                SHA-256:AA8866D58BEAB07548180628FF423887BBF48AADB1B55392B288F7310F94A9B1
                                                                                                                                                                                                                                                SHA-512:68A32B41DC2D3E730D6BE53656B0D566AB1BCC1E189A2FFDB5687A947EF4F4008BC17456F8CE0D59C838EEA87A44400231A44E6AB35BEDBF5D7779E1CD7EFD8A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rankin_Inlet) {.. {-9223372036854775808 0 0 -00}.. {-410227200 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {7

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Recife

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1420
                                                                                                                                                                                                                                                Entropy (8bit):3.78262494063765
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5aLexyGcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaI1kR8nd:5eTChlvEw6kSSx5H4a8tf3fkuoYVZDm+
                                                                                                                                                                                                                                                MD5:4D12651CEE804EB9F29567CB37F12031
                                                                                                                                                                                                                                                SHA1:54B2613475B8BDB1DBCCA53A4895DA021F66BDC0
                                                                                                                                                                                                                                                SHA-256:A36AD4614FC9A2A433712B555156EDE03980B88EB91D8DC7E8B10451D6D7F7D3
                                                                                                                                                                                                                                                SHA-512:E6690F6B6DF613C8B7289A2DB71FBC9B87B997707A6C3B4B45BDE8F347082AE8C69F212BAACE50F3C04E325ABE0976AF1F61107BDF8A15D5B88F11FAE11A9D00
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Recife) {.. {-9223372036854775808 -8376 0 LMT}.. {-1767217224 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Regina

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1781
                                                                                                                                                                                                                                                Entropy (8bit):4.034282439637634
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290hjmdHfCv24Q1NAvHaE+YB+Q4kRcMxIeRUVX/SEQd1rRR9xRv0+Ro/wPjp:5EjeavTGOtAVvSRBpx0yq1epwD+yz+
                                                                                                                                                                                                                                                MD5:14B29B4391B643E5707096ADCC33C57E
                                                                                                                                                                                                                                                SHA1:B3F875ABB79C634C74307B7CB7B276B13AEE11D1
                                                                                                                                                                                                                                                SHA-256:50105E788288CF4C680B29BBDCDE94D8713A5361B38C6C469FD97CF05503FF7D
                                                                                                                                                                                                                                                SHA-512:D92A51547DF2C1AB6E6CDEFF34C07B755D3F6BB5E7DD1907693E7658EDE4D2BADC5DEFDB658ADD0F8D8F14B3B87CEA17BC00DAC364C5CB7ACBF8778C245276A9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Regina) {.. {-9223372036854775808 -25116 0 LMT}.. {-2030202084 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1251651600 -21600 1 MDT}.. {-1238349600 -25200 0 MST}.. {-1220202000 -21600 1 MDT}.. {-1206900000 -25200 0 MST}.. {-1188752400 -21600 1 MDT}.. {-1175450400 -25200 0 MST}.. {-1156698000 -21600 1 MDT}.. {-1144000800 -25200 0 MST}.. {-1125248400 -21600 1 MDT}.. {-1111946400 -25200 0 MST}.. {-1032714000 -21600 1 MDT}.. {-1016992800 -25200 0 MST}.. {-1001264400 -21600 1 MDT}.. {-986148000 -25200 0 MST}.. {-969814800 -21600 1 MDT}.. {-954093600 -25200 0 MST}.. {-937760400 -21600 1 MDT}.. {-922039200 -25200 0 MST}.. {-906310800 -21600 1 MDT}.. {-890589600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-748450800 -21600 1 MDT}.. {-732729600 -25200 0 MST

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Resolute

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7610
                                                                                                                                                                                                                                                Entropy (8bit):3.8312000314798085
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:li8h4Z80NA604qSScBgN+4ctDzIVQ/c/3hNxTh:EqOzA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:541EACD872723603971058CB205121D7
                                                                                                                                                                                                                                                SHA1:8F7DFD5ECA2913846D9342839AE1C60882153DA0
                                                                                                                                                                                                                                                SHA-256:643CC43E3F906779C040E1F0C20E78D6E95CC7301B3C7370A8ADBCBD76A8C5E8
                                                                                                                                                                                                                                                SHA-512:971D06D3FB67B7AE79EEDB6D3EBB805B5992C2BF4A7166016B405E21BFB25D9A87A757E8065073D5FBEB9084F6F742269A5BF432BF2F03D30913DB092E1AB3A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Resolute) {.. {-9223372036854775808 0 0 -00}.. {-704937600 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {73391

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Rio_Branco

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1112
                                                                                                                                                                                                                                                Entropy (8bit):3.8413073465060457
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5Ybe/k5Yss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6Gs:505YsMw57XJh4CxUF/A6GTrtSUDwr
                                                                                                                                                                                                                                                MD5:7E23FDE0E158E8ED2E7536EDE70D2588
                                                                                                                                                                                                                                                SHA1:319052BE076DC79F130E807D68B11CCAA0636340
                                                                                                                                                                                                                                                SHA-256:28082D20872B61D6098D31D1C40F12464A946A933CD9AF74475C5AF384210890
                                                                                                                                                                                                                                                SHA-512:BE078ED12F05AB5CEE5D77212EB76A01A1BC52EEAA17E3B91D93B88D75E5281B6AF164E712A9AB0F57A21B3CDB20F6FCCADB73CAC4745B5D2E665D18F9F06B55
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rio_Branco) {.. {-9223372036854775808 -16272 0 LMT}.. {-1767209328 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {57120480

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Rosario

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):219
                                                                                                                                                                                                                                                Entropy (8bit):4.801485647578614
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7/MSHAIgp/M1ovN/290rI5290/M7:MByMY/M7p/M16t290r190/M7
                                                                                                                                                                                                                                                MD5:90830F3B1F91FE48AC2944C7C92A3F6E
                                                                                                                                                                                                                                                SHA1:777377AE4959DDD2B472EB6041A23A5B93D64BB6
                                                                                                                                                                                                                                                SHA-256:0117D33D4F326AA536162D36A02439FBD5F2EB3B4F540B5BA91ED7747DDAC180
                                                                                                                                                                                                                                                SHA-512:20A371E4550E402AFEB83EF19EFFF6B3C0D7A68DCAA06AD894D04DB63B7096560E701C45B455B23A98BB20FE3B590F920219152415CA506AEDA427BB1381B826
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Santa_Isabel

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):194
                                                                                                                                                                                                                                                Entropy (8bit):4.869058214823402
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7ekHAIgpeON/290tX2U490eBn:MByMYMpJt290c90m
                                                                                                                                                                                                                                                MD5:F4E62378AA05771D348AA6DA516CD386
                                                                                                                                                                                                                                                SHA1:07FCA813693F7944CBCBB128F2F2FE32929D37A2
                                                                                                                                                                                                                                                SHA-256:3B4C2F3A5B9CD22A73F05187C032723D07BB53C9946D04D35E1BA1CB90CA0A62
                                                                                                                                                                                                                                                SHA-512:E9F6CEB824D656CA25A72BF8EB4347A22E1A8E40410F01E0C2EDE19ACAF32D76540399796B3EBC7781C8B5D48C1A6B2C856CA06158AE37D95C95CF0567DFA2E5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Santa_Isabel) $TZData(:America/Tijuana)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Santarem

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1079
                                                                                                                                                                                                                                                Entropy (8bit):3.8200568741699223
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5zeUdunSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/h:52SeSFESoSQSrSsCSeSPS1cSQSQlSsSU
                                                                                                                                                                                                                                                MD5:7F2658032008F2C1308F121C2EBF2479
                                                                                                                                                                                                                                                SHA1:B6F24E818B4424C0DEF818C103D1DA5359958932
                                                                                                                                                                                                                                                SHA-256:4A397BD937DE1D7E6A941D18001B34D4CD195AEFD08951C30C7EE8E48656AA0E
                                                                                                                                                                                                                                                SHA-512:F78853AA75F58A85555DD79E08A7487E5161854650DBF480189790D855738FEDCBDA936870067DE40FE000861008A9E9AAF61DF02B6B30B96038C61B5E1F1C1D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santarem) {.. {-9223372036854775808 -13128 0 LMT}.. {-1767212472 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Santiago

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8871
                                                                                                                                                                                                                                                Entropy (8bit):3.5351636359890537
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:2Xv/lxUQjzoMUBI0nuUoDK6lPlgiot7JC/k8NWse4r4g5xCEmMQUs8nCxvisEbzu:2fD9TzDC9g32+E
                                                                                                                                                                                                                                                MD5:81FC6AFF68B1CF2EA57ED13A42B35BE1
                                                                                                                                                                                                                                                SHA1:5889E502FBDCBCDFE9E7053625FFFBAD61FFE256
                                                                                                                                                                                                                                                SHA-256:77CED11337F43241D57C10BA752C7104A7AF8727992E7B90A3C5D62AA15E81C7
                                                                                                                                                                                                                                                SHA-512:7756CBAF76966F3D45883B725B791A8DD60E8329F6FE19C12029C6FEBC90D7322765A0A8BA26FC586443A902B372D0C0189426A8F99B2B535BB8F1EE74796B44
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santiago) {.. {-9223372036854775808 -16965 0 LMT}.. {-2524504635 -16965 0 SMT}.. {-1892661435 -18000 0 -05}.. {-1688410800 -16965 0 SMT}.. {-1619205435 -14400 0 -04}.. {-1593806400 -16965 0 SMT}.. {-1335986235 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-740520000 -10800 1 -03}.. {-736635600 -14400 1 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Santo_Domingo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):616
                                                                                                                                                                                                                                                Entropy (8bit):4.330655351784895
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290/StmdHhvCvuCY/h/uFkS/5MVvMrW//MVvMrpx/m0XVvMr4UB/47VvMr/d:5+seQvuCY5/u/REfk+xxdbUBQpu652GO
                                                                                                                                                                                                                                                MD5:FAD0621010889164ADC4472003C9391F
                                                                                                                                                                                                                                                SHA1:C4EE0B8D6925338D17D5745DE9D45FA3C628DFC5
                                                                                                                                                                                                                                                SHA-256:2217E72B11A90F2D679C175DE3CC0F2FED4C280C9FF9707CFFAF118BF9A06A4B
                                                                                                                                                                                                                                                SHA-512:90E8E5A109CD72458C7796CF0324F63E543CCD63D13A09A3DD28EDC8B2793C964C18E79FDF0C5067C5A481B7FB03E8413139C32F59DA07E9D7893378ABBBD2B3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santo_Domingo) {.. {-9223372036854775808 -16776 0 LMT}.. {-2524504824 -16800 0 SDMT}.. {-1159773600 -18000 0 EST}.. {-100119600 -14400 1 EDT}.. {-89668800 -18000 0 EST}.. {-5770800 -16200 1 -0430}.. {4422600 -18000 0 EST}.. {25678800 -16200 1 -0430}.. {33193800 -18000 0 EST}.. {57733200 -16200 1 -0430}.. {64816200 -18000 0 EST}.. {89182800 -16200 1 -0430}.. {96438600 -18000 0 EST}.. {120632400 -16200 1 -0430}.. {127974600 -18000 0 EST}.. {152082000 -14400 0 AST}.. {975823200 -14400 0 AST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Sao_Paulo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2900
                                                                                                                                                                                                                                                Entropy (8bit):3.6548008349990755
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5uFChlvEwR9xSSx5H4a8tf3fku+da2XUd23t8VZDG8+w/ghBPWTRz908a9zRgwun:cFIlvEwZSSxdF8tfMu+da2kdCt8VZy8n
                                                                                                                                                                                                                                                MD5:F6B732A862659EB131C2E6FEC00E9734
                                                                                                                                                                                                                                                SHA1:49517DF63BC5B6FEC875CE9477BBF84F4072FA31
                                                                                                                                                                                                                                                SHA-256:0E7BA1C5A3FA3DABDAA226BFE1E8D797A3835EA554828881AB5E365EDA09B92E
                                                                                                                                                                                                                                                SHA-512:670A5B604B5EA0F5FA15083BC1EA115B7EFD449F9EAC4518E109493591893DD3627AFC6628E0EDD1953E932E2A7AD9B5A379526548677158EC445366E4ED7166
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sao_Paulo) {.. {-9223372036854775808 -11188 0 LMT}.. {-1767214412 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-195429600 -7200 1 -02}.. {-189381600 -7200 0 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Scoresbysund

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6839
                                                                                                                                                                                                                                                Entropy (8bit):3.565857684485945
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:9OgtbdF7TI7nYUYXg9W/OAcv7vuShytWi0PnvLrqPoKR2XszXckXtogYN4Ezlk0X:PJr9Q7TMq+ML
                                                                                                                                                                                                                                                MD5:D1BF579FE8123E8EE9248A51E794CC78
                                                                                                                                                                                                                                                SHA1:BF9CB9BED143C7529719E0C1E2F88BE1AC9F8DD4
                                                                                                                                                                                                                                                SHA-256:158BD9E4EB0B9DFF3F2D3E2DBA72F217B73423012DD33A688FD57852124E884A
                                                                                                                                                                                                                                                SHA-512:78192AC38912021F848592D0B208CB122EFFC6DDB326540FFAADA4FD3322B7A442FD1116F408D64B8788520B46545DFAE571EA42046D62A282A97ECCD5663655
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Scoresbysund) {.. {-9223372036854775808 -5272 0 LMT}.. {-1686090728 -7200 0 -02}.. {323841600 -3600 0 -01}.. {338961600 -7200 0 -02}.. {354679200 0 0 +00}.. {370400400 -3600 0 -01}.. {386125200 0 1 +00}.. {401850000 -3600 0 -01}.. {417574800 0 1 +00}.. {433299600 -3600 0 -01}.. {449024400 0 1 +00}.. {465354000 -3600 0 -01}.. {481078800 0 1 +00}.. {496803600 -3600 0 -01}.. {512528400 0 1 +00}.. {528253200 -3600 0 -01}.. {543978000 0 1 +00}.. {559702800 -3600 0 -01}.. {575427600 0 1 +00}.. {591152400 -3600 0 -01}.. {606877200 0 1 +00}.. {622602000 -3600 0 -01}.. {638326800 0 1 +00}.. {654656400 -3600 0 -01}.. {670381200 0 1 +00}.. {686106000 -3600 0 -01}.. {701830800 0 1 +00}.. {717555600 -3600 0 -01}.. {733280400 0 1 +00}.. {749005200 -3600 0 -01}.. {764730000 0 1 +00}.. {780454800 -3600 0 -01}.. {796179600 0 1 +00}.. {8

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Shiprock

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.888573146674231
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/2IAcGEtOFBx+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/290tO09Z
                                                                                                                                                                                                                                                MD5:2FF74846ADF32AA3A9418376775B7F25
                                                                                                                                                                                                                                                SHA1:130D7548DFFEBCE74969962E335B40299D7C5C54
                                                                                                                                                                                                                                                SHA-256:BF4FAB3AE72CC7FA4F9E34CF0551A85C54A084CD826DF5D9CC684DE6188E84DB
                                                                                                                                                                                                                                                SHA-512:9E52C017E595EEF1C68C8A1943416A9109D7DB4C32D25F83D05213C4200869A50E2E726894E39ECA364C558BB7F5566F6150CEA5D3CB14D1DEAE28C3D8C810E0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:America/Shiprock) $TZData(:America/Denver)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Sitka

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8651
                                                                                                                                                                                                                                                Entropy (8bit):3.959337076866423
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:IGCG0hPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:I5G0A9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                                                                                MD5:7CCB6902749079A0496F1E2E2137448E
                                                                                                                                                                                                                                                SHA1:3D0ED7BF1C26659F6794E26AE3869F8AB925B6DF
                                                                                                                                                                                                                                                SHA-256:ABB08435CAE80119068A85984BFFE9C1596F4FB90F07CC01124C907E5162C189
                                                                                                                                                                                                                                                SHA-512:0B5B2DCECC70F357DB6D590AB63E600C572EA6B3F430565EFEB29777B1901AAC55CACC7495C668F739201076B180402141BC1B2ED2357E9B4DFBABF3B122AB44
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sitka) {.. {-9223372036854775808 53927 0 LMT}.. {-3225223727 -32473 0 LMT}.. {-2188954727 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {3099492

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\St_Barthelemy

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):207
                                                                                                                                                                                                                                                Entropy (8bit):4.932842207797733
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290txP90ppv:MByMYbpwt2907P90b
                                                                                                                                                                                                                                                MD5:CBFA61DBF6F7459CF8D517402B29998E
                                                                                                                                                                                                                                                SHA1:A562B29C9470DBD25480966B0462433124BA4164
                                                                                                                                                                                                                                                SHA-256:353CDBD46BA8C7472A93E9E800A69105801F6784B22EC50A59294CDC3BE40E18
                                                                                                                                                                                                                                                SHA-512:00B333EAA2C32EDDA8F06457AD0E10013A0147B20F504F4F1096656F731A7C1896D5ABD83E7EDBD5D4E7DA587EE9BFA796539EB1E9F4056D75D1FDF203251150
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Barthelemy) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\St_Johns

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11289
                                                                                                                                                                                                                                                Entropy (8bit):3.8713946894934614
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:PmxVjd1cO8f7/EjUhSicN6zvfwb+8YbTE0M0J:PmrcOI7/EjiskY01J
                                                                                                                                                                                                                                                MD5:8F068899DA75663128320633E1881333
                                                                                                                                                                                                                                                SHA1:E9161B45D7B11A2DD6E9679AC080E84EC51561E3
                                                                                                                                                                                                                                                SHA-256:E2917204B0C843C32051BB371CF6D0AD272C02720B9C0D913AC072C8ABE1EC64
                                                                                                                                                                                                                                                SHA-512:2200E9B9D816157330ADAEA7383635876E5A37329B1AF9613D38BCFBE8143835837A25132A94E44A61DB8058ED98B1A33F295EA64BC1F4CE30966D52BB0B673D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/St_Johns) {.. {-9223372036854775808 -12652 0 LMT}.. {-2713897748 -12652 0 NST}.. {-1664130548 -9052 1 NDT}.. {-1650137348 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1598650148 -9052 1 NDT}.. {-1590100148 -12652 0 NST}.. {-1567286948 -9052 1 NDT}.. {-1551565748 -12652 0 NST}.. {-1535837348 -9052 1 NDT}.. {-1520116148 -12652 0 NST}.. {-1503782948 -9052 1 NDT}.. {-1488666548 -12652 0 NST}.. {-1472333348 -9052 1 NDT}.. {-1457216948 -12652 0 NST}.. {-1440883748 -9052 1 NDT}.. {-1425767348 -12652 0 NST}.. {-1409434148 -9052 1 NDT}.. {-1394317748 -12652 0 NST}.. {-1377984548 -9052 1 NDT}.. {-1362263348 -12652 0 NST}.. {-1346534948 -9052 1 NDT}.. {-1330813748 -12652 0 NST}.. {-1314480548 -9052 1 NDT}.. {-1299364148 -12652 0 NST}.. {-1283030948 -9052 1 ND

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\St_Kitts

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):202
                                                                                                                                                                                                                                                Entropy (8bit):4.907031043022691
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tMp490ppv:MByMYbpwt290g490b
                                                                                                                                                                                                                                                MD5:D521F2D9B28C5374FC3BD540C6B6F40D
                                                                                                                                                                                                                                                SHA1:39A3D86CB71F742F33B02F50B316638815B3CD4E
                                                                                                                                                                                                                                                SHA-256:EDB9457A7C64E47062BDC6458FD3BCFCD6C37820F1A2BC89DFE99ED77355011F
                                                                                                                                                                                                                                                SHA-512:05C1BE92550A962904ED3BB7DECCAC16FCB54D258F24F2AEDF755FCC44E4FEF5F86AB663945809F5D7AFA64178E807BBDAE77048270ED516DFF2C7720A746D52
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Kitts) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\St_Lucia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):202
                                                                                                                                                                                                                                                Entropy (8bit):4.9037013606484905
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tY90ppv:MByMYbpwt290a90b
                                                                                                                                                                                                                                                MD5:9392E5A7BD198B0308F9271E4C7E59B2
                                                                                                                                                                                                                                                SHA1:A902440920A0318BC930957C74804A9A51EF7818
                                                                                                                                                                                                                                                SHA-256:6727A509BB937CB3446D41B57826DE70C7028E96F088AB5B7F803BEAA18279E8
                                                                                                                                                                                                                                                SHA-512:6DA1EAC390E72905DF1A14D82362B499D20FAD6D85F3DF116AE01E566D5D19C6D16E56DA72C458BB6143345EF45F35A53B245488C641D80BFBA200B16A59719E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Lucia) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\St_Thomas

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):203
                                                                                                                                                                                                                                                Entropy (8bit):4.919272465019375
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tXIMFJ490ppv:MByMYbpwt290tJ490b
                                                                                                                                                                                                                                                MD5:49D0C8DAFCA053C9967EDCC4C0A484B1
                                                                                                                                                                                                                                                SHA1:7B4999D4B9AD93306BD411DF2946D741EC597770
                                                                                                                                                                                                                                                SHA-256:974AEED3D79124B50265C83D84F23CBE4F0328D00C75F42DD3ABC5D4C0A78DE1
                                                                                                                                                                                                                                                SHA-512:378E3657B26C5A039FF82ECCAC7797FF45CBC6479596629B3048164EE4E035F4ECFC557AA9EAF6848E78999B4FF8C63E53C7163BDF6F626ED6111004490D6F80
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Thomas) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\St_Vincent

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.909053768717241
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tzb+Q90ppv:MByMYbpwt290xyQ90b
                                                                                                                                                                                                                                                MD5:6CFB23E7164605CDE380FB7C4D88DF11
                                                                                                                                                                                                                                                SHA1:CC513B29AD7B59E600DBCBC97927EB632558F657
                                                                                                                                                                                                                                                SHA-256:6B19404D295964EF66F47802836BB728FCE8E6481115797C0B5F200C354D7C8A
                                                                                                                                                                                                                                                SHA-512:728987D0925B6E12E8A220920BEDF94180880E78F3F08F6AC740E6304B22D446846068CEA499F61E7032ADB2E700CE31954921D478C9A8B6CB599E05A6292EA3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Vincent) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Swift_Current

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):874
                                                                                                                                                                                                                                                Entropy (8bit):4.253846650171654
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86290hEbmdHLCvYX4Q19xRv0+RmwPj+uLkQOzL3+ORL4FXgenM7RSslKA1PyKp:5zeOvT4xuyqoYaAxt7l
                                                                                                                                                                                                                                                MD5:C91F801CC5E9F78B966D1DF2259C38A8
                                                                                                                                                                                                                                                SHA1:D29C970CBFC74684D46AAAD543B73B520775632C
                                                                                                                                                                                                                                                SHA-256:939B25C9412B9E25D73F552E87826999FC8C929770E66491D1E4530046D3E758
                                                                                                                                                                                                                                                SHA-512:093378E61DE9310F9C48170CBB0FDBD3C79E184DA1489F759B20BCE410006A9D5A793C82E79A46E0AFF0DAA47D9DBAFD605959E491BA9ED4E55D26F293642D32
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Swift_Current) {.. {-9223372036854775808 -25880 0 LMT}.. {-2030201320 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-747241200 -21600 0 MDT}.. {-732729600 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {-684342000 -21600 1 MDT}.. {-671040000 -25200 0 MST}.. {-652892400 -21600 1 MDT}.. {-639590400 -25200 0 MST}.. {-631126800 -25200 0 MST}.. {-400086000 -21600 1 MDT}.. {-384364800 -25200 0 MST}.. {-337186800 -21600 1 MDT}.. {-321465600 -25200 0 MST}.. {-305737200 -21600 1 MDT}.. {-292435200 -25200 0 MST}.. {-273682800 -21600 1 MDT}.. {-260985600 -25200 0 MST}.. {73472400 -21600 0 CST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Tegucigalpa

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):341
                                                                                                                                                                                                                                                Entropy (8bit):4.638828647226646
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2903fDm2OHskeoHxbV1ULhgdrV/uF+IcmJ3/uF+ivi9/uF+SNv:MB862903LmdHsVCn1ULSB/uF+QV/uF+q
                                                                                                                                                                                                                                                MD5:4C4034ABAB9E4804CCB23E51694044C9
                                                                                                                                                                                                                                                SHA1:7DB24CE83AB2C07E6F6784D27C4E3AC0F149D080
                                                                                                                                                                                                                                                SHA-256:1F0503579B0DDDBAF88814A278127D9CD7019EDD3C35F4CBFC0EF11C0EDAFE5B
                                                                                                                                                                                                                                                SHA-512:0BC366CD3AB2E1388D11770DC8DEC1FC94C48FDC846ABB6C487828BF9FF15CD9A1C15B33E08F6E48B7F4A6F2AD1617FF12B359784CA4C32256D72422E6825105
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tegucigalpa) {.. {-9223372036854775808 -20932 0 LMT}.. {-1538503868 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}.. {1146981600 -18000 1 CDT}.. {1154926800 -21600 0 CST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Thule

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6890
                                                                                                                                                                                                                                                Entropy (8bit):3.8331465442823704
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:mJInJuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/Bm6BTd69xK7KjhVbHyR3h1gOZM:miFCC
                                                                                                                                                                                                                                                MD5:D93B62D5F7EEBC28AC047BED2307CAE8
                                                                                                                                                                                                                                                SHA1:8B3E02240A01B5AA42D30E86005E880916432227
                                                                                                                                                                                                                                                SHA-256:7FB0CBB101D3B6FBB6B9DAD5446BBF9E6AEC65EC38472739E604F68F6AA9AB7B
                                                                                                                                                                                                                                                SHA-512:3648106F4DF84CFD94AAD4E9430F8D3BBCB38A9196DE9A59246DFBBC170FADBF106DD1FD08FE2E4F7319BFFB1C2607E4F5D563C222CED8267483D1A0C388CCE5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thule) {.. {-9223372036854775808 -16508 0 LMT}.. {-1686079492 -14400 0 AST}.. {670399200 -10800 1 ADT}.. {686120400 -14400 0 AST}.. {701848800 -10800 1 ADT}.. {717570000 -14400 0 AST}.. {733903200 -10800 1 ADT}.. {752043600 -14400 0 AST}.. {765352800 -10800 1 ADT}.. {783493200 -14400 0 AST}.. {796802400 -10800 1 ADT}.. {814942800 -14400 0 AST}.. {828856800 -10800 1 ADT}.. {846392400 -14400 0 AST}.. {860306400 -10800 1 ADT}.. {877842000 -14400 0 AST}.. {891756000 -10800 1 ADT}.. {909291600 -14400 0 AST}.. {923205600 -10800 1 ADT}.. {941346000 -14400 0 AST}.. {954655200 -10800 1 ADT}.. {972795600 -14400 0 AST}.. {986104800 -10800 1 ADT}.. {1004245200 -14400 0 AST}.. {1018159200 -10800 1 ADT}.. {1035694800 -14400 0 AST}.. {1049608800 -10800 1 ADT}.. {1067144400 -14400 0 AST}.. {1081058400 -10800 1 ADT}.. {1099198800 -14400 0 AST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Thunder_Bay

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):193
                                                                                                                                                                                                                                                Entropy (8bit):4.838326820531248
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7RQtHAIgpRQPN/2903MA90RQk:MByMYzp4t2903MA90D
                                                                                                                                                                                                                                                MD5:D68B69B05D8743977BA4815B8AFE8E92
                                                                                                                                                                                                                                                SHA1:364796989B6DD0110F1D85A8844419EB49772EC0
                                                                                                                                                                                                                                                SHA-256:845101F85A6DAF9DEB58A075473F9E541A0B68461677779B1461DE59E3FA3D18
                                                                                                                                                                                                                                                SHA-512:DEAA60DDF1521C269D7D386A7FCC40C8FAFB00EEA6764E6B23F4C65B8F6F596B3D5D2D3F6F7B1C22016C530B8789839F8052FDE1C2794C9F9C700C46DC8A3AEE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Thunder_Bay) $TZData(:America/Toronto)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Tijuana

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8755
                                                                                                                                                                                                                                                Entropy (8bit):3.8521303835918115
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:CuS6mjvZk53mtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:26jFOzN6IkWq/WHQt/RY4yP
                                                                                                                                                                                                                                                MD5:2F9983FE6248F3BF18ADE00192F4B458
                                                                                                                                                                                                                                                SHA1:73F7302C914E442FC50DD4BFF3C57FD310E6455C
                                                                                                                                                                                                                                                SHA-256:D7C5CB477A591931FF03C794C84EDB2319760C0B70047B325382F211E28648E3
                                                                                                                                                                                                                                                SHA-512:B1F66008F2B62D4E1B59ED1A78A9E4F5D06BE074EB3B2466BDE3C9ED98DE96AD03FACDB8EDA6EE8F8EE890860DE6011F2BB364DE8C1276B31F37C9C525F4EC3F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tijuana) {.. {-9223372036854775808 -28084 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1451667600 -28800 0 PST}.. {-1343062800 -25200 0 MST}.. {-1234803600 -28800 0 PST}.. {-1222963200 -25200 1 PDT}.. {-1207242000 -28800 0 PST}.. {-873820800 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-761677200 -28800 0 PST}.. {-686073600 -25200 1 PDT}.. {-661539600 -28800 0 PST}.. {-504892800 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}.. {-355330800 -28800 0 PST}.. {-337186800 -25200 1 PDT}.. {-323881200 -28800 0 PST}.. {-305737200 -25200 1 PDT}.. {-292431600 -28800 0 PST}.. {-283968000 -28800 0 PST}.. {189331200 -28800 0 PST}.. {19

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Toronto

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11248
                                                                                                                                                                                                                                                Entropy (8bit):3.8061065077303926
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:lBew85RnK1a8phYBNXEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:lBq5RnK1a8phYTXEItON0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:0D906EC3F658730131A65C5A770D885F
                                                                                                                                                                                                                                                SHA1:BFA72C43BCE0F37F795E974457FBE4A664687B38
                                                                                                                                                                                                                                                SHA-256:5A98C6BEDDA4DF608051D702A8E037093A8068E1B85F8F55D42B4468F45662A5
                                                                                                                                                                                                                                                SHA-512:CC634DAF4EEC7F57E3AB0C20D891380A7F96DE79602A7B57C6C2BF229DD76A69B399A689FA6D0675380B1432C2115B0C8577DC49C3C9E567A08CAD6FCC3599BC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Toronto) {.. {-9223372036854775808 -19052 0 LMT}.. {-2366736148 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1609441200 -18000 0 EST}.. {-1601753400 -14400 1 EDT}.. {-1583697600 -18000 0 EST}.. {-1567357200 -14400 1 EDT}.. {-1554667200 -18000 0 EST}.. {-1534698000 -14400 1 EDT}.. {-1524074400 -18000 0 EST}.. {-1503248400 -14400 1 EDT}.. {-1492365600 -18000 0 EST}.. {-1471798800 -14400 1 EDT}.. {-1460916000 -18000 0 EST}.. {-1440954000 -14400 1 EDT}.. {-1428861600 -18000 0 EST}.. {-1409504400 -14400 1 EDT}.. {-1397412000 -18000 0 EST}.. {-1378054800 -14400 1 EDT}.. {-1365962400 -18000 0 EST}.. {-1346605200 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-1238954400

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Tortola

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.864308662322047
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290RRKl290ppv:MByMYbpwt290V90b
                                                                                                                                                                                                                                                MD5:21D152A2359A4EFDE6DCC304F16096F3
                                                                                                                                                                                                                                                SHA1:961B3CFB351615604981114A115D396D1F2006A2
                                                                                                                                                                                                                                                SHA-256:46A236EC38F3A122D414208328A462B2A937392ECC6C55F673FB7A402F118D96
                                                                                                                                                                                                                                                SHA-512:04A2AD6DDC2E7B0D3F95DA1C731FF553F8CBC0DD6BDFC36FB2EDCE755612103E3B4EA6F3AB7FE63CA60976538EFABF40827539DFC35B7E83129BD48471FE514B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Tortola) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Vancouver

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9815
                                                                                                                                                                                                                                                Entropy (8bit):3.8481935495337356
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:sOR864CjSAG5a9bFzN6IkWq/WHQt/RY4yP:sO664CjSAGYbGBt/M
                                                                                                                                                                                                                                                MD5:9423BC81647BC4C37888860CE0518BBB
                                                                                                                                                                                                                                                SHA1:37E6E6554576D1DD36C3494EAF0BD169003D870D
                                                                                                                                                                                                                                                SHA-256:00B5FB8F37DFF43925C501AEAB039F39F058E002572C4203286317046CC1D700
                                                                                                                                                                                                                                                SHA-512:1830CA2B62B7CA6EEB5A924D2148925DF7DD87A7B93B21F4F023E4678EF42DC20BFF57F702923E10F4382FE6757323D21414D094E99FEEB43316DE4A7E5A909E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Vancouver) {.. {-9223372036854775808 -29548 0 LMT}.. {-2713880852 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-747237600 -25200 1 PDT}.. {-733935600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-4

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Virgin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):200
                                                                                                                                                                                                                                                Entropy (8bit):4.914983069791254
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290RXgr490ppv:MByMYbpwt290xg090b
                                                                                                                                                                                                                                                MD5:9F7DA15BE387B8F7DEC5DFFE069F3505
                                                                                                                                                                                                                                                SHA1:D298B963B0048E9ECA3BC7B85248506AB1388479
                                                                                                                                                                                                                                                SHA-256:561D9D04B0CE0F96A9C351C7D5C30AA1D5A42A3D70066CD9AF0DA6CBC5388DBE
                                                                                                                                                                                                                                                SHA-512:606C2A918633C74BD2954D39B00EFA2CD9DA852BC7034F129A04258A65DC74942FA0826E9BC6E4433926E7F1375612554B04845077E434D0CD3BD15832DC6B95
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Virgin) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Whitehorse

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2971
                                                                                                                                                                                                                                                Entropy (8bit):3.9652694533791917
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5CeFvmpn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5BmCKpj/AOZFCARCeQbvb5wxMN6Ix
                                                                                                                                                                                                                                                MD5:2F2D39B5FB844E170FA7B6AF11B948CA
                                                                                                                                                                                                                                                SHA1:3D89672134D979FCF65225A58249380D9C8A4A65
                                                                                                                                                                                                                                                SHA-256:8E0BC71BD7146145DDE3C064AE205DF08124FE2402853A9655B0EB799E90F31F
                                                                                                                                                                                                                                                SHA-512:6C046D1133C8CCF697C8FB553A1F539948F71FA80BA447B87AA8D1D1D7113B32A6B764C5C1734C615319A27961B6116FCA087EB571869119BE87656FCA351498
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Whitehorse) {.. {-9223372036854775808 -32412 0 LMT}.. {-2188997988 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Winnipeg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9695
                                                                                                                                                                                                                                                Entropy (8bit):3.8209220355628766
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:pOEhc8/rvNZONqXXyIjNA604qSScBgN+4ctDzIVQ/c/3hNxTh:pY8DvbO+A604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:E8DB00D2B99B308018F4F5E48AC47C3A
                                                                                                                                                                                                                                                SHA1:8841467CB264DC9F87FABAADBE90EE2C8DACC80F
                                                                                                                                                                                                                                                SHA-256:F3FC5F6D93D1D9EB0F3DED33873F33C47F841797D96439966F8E0A5A189941FA
                                                                                                                                                                                                                                                SHA-512:5D684B07332ED53F9F8CB71FFF3B6D0F848426A5E4D9E7DA84E49E358C666F1C3BB9CF21352D939B35B558FC691839E24BC84656317F73C768B474AF5AC480EB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Winnipeg) {.. {-9223372036854775808 -23316 0 LMT}.. {-2602258284 -21600 0 CST}.. {-1694368800 -18000 1 CDT}.. {-1681671600 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1029686400 -18000 1 CDT}.. {-1018198800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-746035200 -18000 1 CDT}.. {-732733200 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620755200 -18000 1 CDT}.. {-607626000 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Yakutat

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8683
                                                                                                                                                                                                                                                Entropy (8bit):3.957710943557426
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:po1acs6yyyxC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:p4acsW9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                                                                                MD5:18EC35FCEC15CE9304818E22222411EF
                                                                                                                                                                                                                                                SHA1:F4A04B3E2B5F55C9582F578C3142E706C4EB6BD6
                                                                                                                                                                                                                                                SHA-256:79B44F245D86A4EC299D1A9A2EDB2AB92D50AB5A7C1C03759D283AC4070F9005
                                                                                                                                                                                                                                                SHA-512:40AC47AC278DF22C7ECFF568456E7C3767B38701B9A2E2639C2201DC53CDD794CF7521BCB773A8AF2A8D4A034D3BBD35BF9788FB5B4E4D51A7A139B3B3353479
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yakutat) {.. {-9223372036854775808 52865 0 LMT}.. {-3225223727 -33535 0 LMT}.. {-2188953665 -32400 0 YST}.. {-883580400 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-757350000 -32400 0 YST}.. {-31503600 -32400 0 YST}.. {-21474000 -28800 1 YDT}.. {-5752800 -32400 0 YST}.. {9975600 -28800 1 YDT}.. {25696800 -32400 0 YST}.. {41425200 -28800 1 YDT}.. {57751200 -32400 0 YST}.. {73479600 -28800 1 YDT}.. {89200800 -32400 0 YST}.. {104929200 -28800 1 YDT}.. {120650400 -32400 0 YST}.. {126702000 -28800 1 YDT}.. {152100000 -32400 0 YST}.. {162385200 -28800 1 YDT}.. {183549600 -32400 0 YST}.. {199278000 -28800 1 YDT}.. {215604000 -32400 0 YST}.. {230727600 -28800 1 YDT}.. {247053600 -32400 0 YST}.. {262782000 -28800 1 YDT}.. {278503200 -32400 0 YST}.. {294231600 -28800 1 YDT}.. {30995

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\America\Yellowknife

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7737
                                                                                                                                                                                                                                                Entropy (8bit):3.8656193813344064
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:42GaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:uPlLv/PCenJzS6cy
                                                                                                                                                                                                                                                MD5:A7606AE597027C26BC90702B2BCC80E9
                                                                                                                                                                                                                                                SHA1:7B2AB2E0A23B8D770D1305A171DBCCE2D471EF2F
                                                                                                                                                                                                                                                SHA-256:B33838F12640C64BA4F10F50657EC4D8D5B30FD226DA4ACA21B169B53AD30576
                                                                                                                                                                                                                                                SHA-512:B18711B4110D6DB0CC7A6EF66639E1B38323F0B61DA4F5287A51BC9EC8534133568C6D3E4F18F6328564DAD291E0CA707768DE4478DD502A40FFD189C08114A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yellowknife) {.. {-9223372036854775808 0 0 -00}.. {-1104537600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Casey

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):478
                                                                                                                                                                                                                                                Entropy (8bit):4.205595904143294
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2L09xSDm2OHE5QMFUH+KNUoTVsBEE0ZZICxZbDtVby:MB862LcUmdHE5QMFi+KdTVPZIwXDy
                                                                                                                                                                                                                                                MD5:7D8132A23238C14CCEDD520BBEB49F77
                                                                                                                                                                                                                                                SHA1:A8BAE9269DAA2AC535B292E1AE8632B451A0BBA5
                                                                                                                                                                                                                                                SHA-256:04247ACB2B4FA126D13F4573FF74D15A89CF42B2C5CD7E688D5BB1C1FD3972BF
                                                                                                                                                                                                                                                SHA-512:74FCB14037B0AE11A95B036791D69037590F8EC7F09D90A866E6A6CAAD6D58E4EC3723A3BB356FBF0E25ED1239A5820A8513EBF6653578E4BFB8988D6D20EF13
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Casey) {.. {-9223372036854775808 0 0 -00}.. {-31536000 28800 0 +08}.. {1255802400 39600 0 +11}.. {1267714800 28800 0 +08}.. {1319738400 39600 0 +11}.. {1329843600 28800 0 +08}.. {1477065600 39600 0 +11}.. {1520701200 28800 0 +08}.. {1538856000 39600 0 +11}.. {1552752000 28800 0 +08}.. {1570129200 39600 0 +11}.. {1583596800 28800 0 +08}.. {1601740860 39600 0 +11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Davis

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                                Entropy (8bit):4.360007144607037
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2L0mDm2OHEfwz0/MVSYyF/KZ7VoX/MVSYyF/VpVQVF9RXhNXSMVSYy6:MB862LVmdHEIjsF/KZOksF/Vp6v9RRFl
                                                                                                                                                                                                                                                MD5:97AA556F7EF06786B76316133794F4E9
                                                                                                                                                                                                                                                SHA1:B3CDA284DE80987B954E2CC9BFA3ED33462CDD4F
                                                                                                                                                                                                                                                SHA-256:2F36D2E13D7E251322B7A7B30F39645393525CEB49A2B5C26F27797F2AAF4D7F
                                                                                                                                                                                                                                                SHA-512:14C6F17252C2AC89D86FE00BD8A8934D627C85478B0AB08AB6237988922D18616B00878498FFFC0E1978308BC6D775E2DC3ADCEF827AB0A06B214BE4DDABAB52
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Davis) {.. {-9223372036854775808 0 0 -00}.. {-409190400 25200 0 +07}.. {-163062000 0 0 -00}.. {-28857600 25200 0 +07}.. {1255806000 18000 0 +05}.. {1268251200 25200 0 +07}.. {1319742000 18000 0 +05}.. {1329854400 25200 0 +07}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\DumontDUrville

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):214
                                                                                                                                                                                                                                                Entropy (8bit):4.938579775653117
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yci/452HAIgObi/4oA6N/2L0/3Zp5/4pv:MByMdNXiU5t2Lkwv
                                                                                                                                                                                                                                                MD5:CC22302B9FAE52E36A2A35C0361E774B
                                                                                                                                                                                                                                                SHA1:45CFD95A5821C4C4FDF2E1519F08029FF0BE664B
                                                                                                                                                                                                                                                SHA-256:96F2AB9A9FFCD10598FDF105F68460CC4B4EBC1F18054D1BC8E39DF6AD24D1AC
                                                                                                                                                                                                                                                SHA-512:FC9084D7B16EAA985681762F2658D32C77EE186D8D3C7225093CC5CB4A6AEB74A3D0A41A904EB6C8AEF7DB110A89497BAFAF811BBC26103F96E5E1D4D4E1002A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Antarctica/DumontDUrville) $TZData(:Pacific/Port_Moresby)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Macquarie

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8447
                                                                                                                                                                                                                                                Entropy (8bit):3.850137279218428
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:s1qigkx6WsYyS391QiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:s1q05h1QiAmcOM6e0pj
                                                                                                                                                                                                                                                MD5:81C612A1544910544173687C416841C6
                                                                                                                                                                                                                                                SHA1:4A707B403F0B9556A3D3D50B08BE0F56660F3F0B
                                                                                                                                                                                                                                                SHA-256:C4EA7F1C0B5A0FAE653419F1C6D058BDDD745A3CDBA11900005C157DF23DDC01
                                                                                                                                                                                                                                                SHA-512:122E2DC3D8D61CCDB83E03C9487DD29AABE7AB3F71FE4F6315209AF0BBCFD01FBDC3A1E3F6D910FB0D690378DF852170A9819D8C1EF96BE6BC8C0811BFB453A9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Macquarie) {.. {-9223372036854775808 0 0 -00}.. {-2214259200 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1669892400 39600 0 AEDT}.. {-1665388800 36000 0 AEST}.. {-1601719200 0 0 -00}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {28932480

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Mawson

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.7511104559982
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEzyeyFNMXGm2OHvavFeVU/VPKVVFSTVF9svUX0VQr:SlSWB9eg/2L0zyfXDm2OHEVy/Ur9s/Vg
                                                                                                                                                                                                                                                MD5:7A2AD9BD8F8DEE5C600CABF2D5E9D07B
                                                                                                                                                                                                                                                SHA1:CF5D230A29946B7FA3ECD8EB99F1EF1BF0FA5B50
                                                                                                                                                                                                                                                SHA-256:ACA533B8BC82296373EDEC82F6E0AA45A34D817C7C18FF5E8E94B81C0BD30259
                                                                                                                                                                                                                                                SHA-512:95F8FA68735E88AB15C403191928FA4AA5D1628453BE64B87EE7E8DF9F35FB5DA74A3CED5F5289A13D84A8A12BBB86734E578059CA8B6405399CFF5E33C9384C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Mawson) {.. {-9223372036854775808 0 0 -00}.. {-501206400 21600 0 +06}.. {1255809600 18000 0 +05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\McMurdo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):195
                                                                                                                                                                                                                                                Entropy (8bit):4.880387042335617
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3ycqXHAIgObOvRN/2L0z6/fy:MByMdTiYt2LrK
                                                                                                                                                                                                                                                MD5:88EE32AE5C538AEBFDE2D1D944ED5B2B
                                                                                                                                                                                                                                                SHA1:55E7234E6FFF298182A6C8889A9F506CDCE7C959
                                                                                                                                                                                                                                                SHA-256:E9D99293C5B275D8E0D7B066084177EDF670D5B52B81E87608BAB02025F33155
                                                                                                                                                                                                                                                SHA-512:45A3EA146CA719BA6F22E99EAA57AC1DED1C762E19BDFBA176E5FEAC36EC58586F771572DD16ACE09E660F97DEB91A701BA1B1F1AEF3BD8688F3451C0772420A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Palmer

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2613
                                                                                                                                                                                                                                                Entropy (8bit):3.6082359166067905
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5fzJS6S4wRSenSOaf7HSKSkSqS7STslSmSMSCSxygSiXS/SrS+S9SfShS7SoSlSL:jdeRtnxaf7HlPlgiot7JC/Xk8NWse4rf
                                                                                                                                                                                                                                                MD5:BDFA5908E735F866FEC16F6B481AD385
                                                                                                                                                                                                                                                SHA1:524AEE21BB97D923A8812A5722AF2FEA43B4D971
                                                                                                                                                                                                                                                SHA-256:1637381A20E9D5C6A530F110BDB08D9515E675C9206F000407D8511074948E61
                                                                                                                                                                                                                                                SHA-512:3D65C7941BA15A698264848F9B6F43ED5B63D4CF86D495334E8E1DC381D63435E9424BBBC389229693D20044FDB8425A7CC805AB5EA055F59D3E0DD4C7AC2A28
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Palmer) {.. {-9223372036854775808 0 0 -00}.. {-157766400 -14400 0 -04}.. {-152654400 -14400 0 -04}.. {-132955200 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-101419200 -10800 1 -04}.. {-86821200 -14400 0 -04}.. {-71092800 -10800 1 -04}.. {-54766800 -14400 0 -04}.. {-39038400 -10800 1 -04}.. {-23317200 -14400 0 -04}.. {-7588800 -10800 0 -03}.. {128142000 -7200 1 -03}.. {136605600 -10800 0 -03}.. {389070000 -14400 0 -04}.. {403070400 -10800 1 -04}.. {416372400 -14400 0 -04}.. {434520000 -10800 1 -04}.. {447822000 -14400 0 -04}.. {466574400 -10800 1 -04}.. {479271600 -14400 0 -04}.. {498024000 -10800 1 -04}.. {510721200 -14400 0 -04}.. {529473600 -10800 1 -04}.. {545194800 -14400 0 -04}.. {560923200 -10800 1 -04}.. {574225200 -14400 0 -04}.. {592372800 -10800 1 -04}.. {605674800 -14400 0 -04}.. {624427200 -10800 1 -04}.. {63712

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Rothera

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):151
                                                                                                                                                                                                                                                Entropy (8bit):4.829975802206526
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEsKRsMXGm2OHvavFN/H3VVFVGAvFv:SlSWB9eg/2L0rRsDm2OHEN/VVFAKV
                                                                                                                                                                                                                                                MD5:C330982049AA053DA62B926627D2F2FA
                                                                                                                                                                                                                                                SHA1:050CE68265F1A183F0173C825AC59EAE8B6AB9EB
                                                                                                                                                                                                                                                SHA-256:943F10D8E836773F0B7ACD13ED8422C0B27813C7BBE0B09B57697D1D70D21ECE
                                                                                                                                                                                                                                                SHA-512:DE9953D0E505D6B110C0CC4E756B5B0311646C9CA4703A33B92147D36CFB4C288D73851E6766CE1432F41AB51B5D0A1D58680BDB4E28F067E1D36F670B4A192E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Rothera) {.. {-9223372036854775808 0 0 -00}.. {218246400 -10800 0 -03}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\South_Pole

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):198
                                                                                                                                                                                                                                                Entropy (8bit):4.906125935761354
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3ycqXHAIgObOvRN/2L0tlo+ply:MByMdTiYt2LMq+p8
                                                                                                                                                                                                                                                MD5:8095A3749DBDE05377836D74A4EEFE33
                                                                                                                                                                                                                                                SHA1:6987CA972B63AE26A65654961588D51D3EF2166C
                                                                                                                                                                                                                                                SHA-256:88057832175BB642B23FC99F788A2F78A24005CF1F84A7B1B5E8C84FB8F4D4C1
                                                                                                                                                                                                                                                SHA-512:9066104C9C16D2AB88523D651C74CE268468E093A497D128D0D12A986BD62DBC1388A56ED1737C2AFACF04185CF06FD0EE66797A3390B2F0E1EB08A4D92AAFAD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Syowa

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.871844665431957
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2L0GRHEtWlFBQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2L0tQB
                                                                                                                                                                                                                                                MD5:CA52057130DCF506D11A7CC069F4FBA3
                                                                                                                                                                                                                                                SHA1:2C38B7E7872BB41C3569DFCB539C3EC3AAE24FDD
                                                                                                                                                                                                                                                SHA-256:2488805DE4FEA42305689F679F1AE2D80B1E934E657FEA329AD39A82DAC63022
                                                                                                                                                                                                                                                SHA-512:B19D409870939C8F0834C6C028239E010EE5128DFA6E97D4903BECA229B04FE530EA376B936767D9BFE21709720C1791289D8E3622B17C18F2680B0670794A02
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Antarctica/Syowa) $TZData(:Asia/Riyadh)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Troll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5370
                                                                                                                                                                                                                                                Entropy (8bit):3.5134546899897146
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:YveRdmbxnKIJqU9XThVIsopb8BcrFgoZVlzeEG+PtJ:UeRdmNnKIIajfopb3FVVJ
                                                                                                                                                                                                                                                MD5:442F495C36B31CA5D7A9BEFF12105AEF
                                                                                                                                                                                                                                                SHA1:B3F6CA5B4A5756F9B2C09A27198F7A651CC6032D
                                                                                                                                                                                                                                                SHA-256:6FD5AB8B7B308CDCEA4B747A81D8675988AE218813C91714FC4CA97919CEBEA5
                                                                                                                                                                                                                                                SHA-512:C6EAECC26D67D218615EBB5602639DAB62A2578BD9683553D765DC1AC5580627D29B6F911388F5F1BFC284278EA4EBECE94630D3C6B95FF9EF93D3D61A3C2028
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Troll) {.. {-9223372036854775808 0 0 -00}.. {1108166400 0 0 +00}.. {1111885200 7200 1 +02}.. {1130634000 0 0 +00}.. {1143334800 7200 1 +02}.. {1162083600 0 0 +00}.. {1174784400 7200 1 +02}.. {1193533200 0 0 +00}.. {1206838800 7200 1 +02}.. {1224982800 0 0 +00}.. {1238288400 7200 1 +02}.. {1256432400 0 0 +00}.. {1269738000 7200 1 +02}.. {1288486800 0 0 +00}.. {1301187600 7200 1 +02}.. {1319936400 0 0 +00}.. {1332637200 7200 1 +02}.. {1351386000 0 0 +00}.. {1364691600 7200 1 +02}.. {1382835600 0 0 +00}.. {1396141200 7200 1 +02}.. {1414285200 0 0 +00}.. {1427590800 7200 1 +02}.. {1445734800 0 0 +00}.. {1459040400 7200 1 +02}.. {1477789200 0 0 +00}.. {1490490000 7200 1 +02}.. {1509238800 0 0 +00}.. {1521939600 7200 1 +02}.. {1540688400 0 0 +00}.. {1553994000 7200 1 +02}.. {1572138000 0 0 +00}.. {1585443600 7200 1 +02}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Antarctica\Vostok

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.940298769001579
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8s4YkyXHAIgNrYOARL/2L0GRHEoKcMFeWFKjov:SlSWB9vsM3yMGSHAIgvAN/2L0XcMFewh
                                                                                                                                                                                                                                                MD5:F61B4D02530B54A8EB1CA7B34BF6D553
                                                                                                                                                                                                                                                SHA1:EB85E044EF9F7D11310C5EBB8D1D0C49A1E3067F
                                                                                                                                                                                                                                                SHA-256:1892E98C13AC141C8C92EAB942B073A464BA5E2C000C250F97F860BE6B108127
                                                                                                                                                                                                                                                SHA-512:E725E909A4056B7E4FADBE66B69E6C4752595F3357E670A7D740A2DA957F2C9502ECA57B9BA874045ED032B8F65A10D11AFAF69EA9673187FD4AE08793492470
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Urumqi)]} {.. LoadTimeZoneFile Asia/Urumqi..}..set TZData(:Antarctica/Vostok) $TZData(:Asia/Urumqi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Arctic\Longyearbyen

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.947168975083595
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/y+YF3vXHAIgoq8yFRRL/2XbeLo4cA4FH/h8QahV:SlSWB9vsM3ymhVoPHAIgoh6N/2XbUyAH
                                                                                                                                                                                                                                                MD5:A4F076D7D716467B78EA382FA222CB38
                                                                                                                                                                                                                                                SHA1:21D7FBA308ADC652F541A0336929B862F7B1BD0B
                                                                                                                                                                                                                                                SHA-256:25462B656D240DA6B01C1A630FAC04B25DD65C799B659BE1C8BD3AB62610966F
                                                                                                                                                                                                                                                SHA-512:1B6BD455E533D5BDC7F3506561A9CA804B1F9CA5CC0665AAB0FC083106AB32FF149DD5FFF62EF7BABAD87E3274F264446D492FB8BE160C9C7F281C7060BF1F61
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Berlin)]} {.. LoadTimeZoneFile Europe/Berlin..}..set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Berlin)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Aden

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):171
                                                                                                                                                                                                                                                Entropy (8bit):4.829666491766117
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFK4h4WFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKs46
                                                                                                                                                                                                                                                MD5:60D7F3194F19179E0CF0F561F9C40EE6
                                                                                                                                                                                                                                                SHA1:B079EC49485CFBFFB7A5BE6149319B75684258E9
                                                                                                                                                                                                                                                SHA-256:8FCDDB246932BAED880B70C0CA867057E7989AEA55EDDC174430E1055CD1058D
                                                                                                                                                                                                                                                SHA-512:0BDC86B1D473D4875C6F7C092F955D0999E6C1F2EF83CFC7726A3C5BFEB0F5CB8E00B1F0CBC1F91F806EC635C472927504DF681A32DAC55EF372DA16FEA9EF40
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Aden) $TZData(:Asia/Riyadh)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Almaty

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1637
                                                                                                                                                                                                                                                Entropy (8bit):3.732051305399264
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5qehddmvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10SvPFu+a+CK/Eu3CWuD0Vob1:5YvdJqxiF0rvK50Sv9fGSM
                                                                                                                                                                                                                                                MD5:D6BCB21F65642F36A159AFD72EC93953
                                                                                                                                                                                                                                                SHA1:D3E670E579924E6E4F04AB574D48334FF521D8B2
                                                                                                                                                                                                                                                SHA-256:06DC608C0B8CDD69CCE66A6BF86F141C46DF39CB45312E684E46F19ED8CAFF15
                                                                                                                                                                                                                                                SHA-512:9A633B629873E5EE5AF923A94865EBE5FD9ECA181B2C47B7368A0828468715E07AD3FD825D5E2312D2D0BA1FA5490E3817C36B6339824C8012A0B75538C4A0DC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Almaty) {.. {-9223372036854775808 18468 0 LMT}.. {-1441170468 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {695768400 21600 0 +06}.. {701812800 25200 1 +06}.. {717537600 21600 0 +06}.. {733262400 25200 1 +06}.. {748987200 21600 0 +06}.. {764712

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Amman

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2682
                                                                                                                                                                                                                                                Entropy (8bit):3.7873260611521915
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5MUNHl0Nhb9bGA9jSb0PWtsjOuH7Ay2n3yy7QYoTZg703q4oPuJ9/YXjpdaOP9kA:Fz0T52akyId7+xOXdkwqeIFcR
                                                                                                                                                                                                                                                MD5:7E70BD44FBF5BF70E3C5246D3A83A49B
                                                                                                                                                                                                                                                SHA1:10A28B0A3189DF347CF9853C024E9467CAC56DBA
                                                                                                                                                                                                                                                SHA-256:B70AABECACD3F62AF506DF395AB44F47F2CA091522B04EC87AC1407172DD1BFA
                                                                                                                                                                                                                                                SHA-512:766565F837EB777749B2C8AAE6C73A2274A772CEF12E7C2E30A89809FEF1E9ED6B067DF044A4676AA4BE76A64A904692C3887336BF01BA4D5D9A5020FB792938
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Amman) {.. {-9223372036854775808 8624 0 LMT}.. {-1230776624 7200 0 EET}.. {108165600 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {215643600 7200 0 EET}.. {231285600 10800 1 EEST}.. {244501200 7200 0 EET}.. {262735200 10800 1 EEST}.. {275950800 7200 0 EET}.. {481154400 10800 1 EEST}.. {496962000 7200 0 EET}.. {512949600 10800 1 EEST}.. {528670800 7200 0 EET}.. {544399200 10800 1 EEST}.. {560120400 7200 0 EET}.. {575848800 10800 1 EEST}.. {592174800 7200 0 EET}.. {610581600 10800 1 EEST}.. {623624400 7200 0 EET}.. {641167200 10800 1 EEST}.. {655074000 7200 0 EET}.. {671839200 10800 1 EEST}.. {685918800 7200 0 EET}.. {702856800 10800 1 EEST}.. {717973200 7200 0 EET}.. {733701600 10800 1 EEST}.. {749422800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Anadyr

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2086
                                                                                                                                                                                                                                                Entropy (8bit):3.7698340044911616
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5DeEdVrEOeFt7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5ZejsFLrcZwvJt2F+doTr9Q3G80
                                                                                                                                                                                                                                                MD5:6EFC35043BDCA4AB61D72E931DB954E6
                                                                                                                                                                                                                                                SHA1:F0B4E76C154DC773073E41AA8E94030E972A986A
                                                                                                                                                                                                                                                SHA-256:D9DF64FDA4638F7604624B0F68A885D5ABADB1DE12AF1AF5581C2AF7DD971562
                                                                                                                                                                                                                                                SHA-512:16AE582B113D6960C73B64620A8AF20F9D436AA4B3EC8E881617AED3389EB4357931882103F162F19EE8202953A7E6FB4FDD6D7760FB7621F4DB9D229AD13F17
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Anadyr) {.. {-9223372036854775808 42596 0 LMT}.. {-1441194596 43200 0 +12}.. {-1247572800 46800 0 +14}.. {354884400 50400 1 +14}.. {370692000 46800 0 +13}.. {386420400 43200 0 +13}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Aqtau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1665
                                                                                                                                                                                                                                                Entropy (8bit):3.7149890651919644
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5uvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIkhYwr:sFBNKs6b03zB0WJEuDa7sFZiKWaN6TiF
                                                                                                                                                                                                                                                MD5:A72FB1FE01C93BD7E0A8136635C72639
                                                                                                                                                                                                                                                SHA1:2383CF839F50784D4BF8B7EDDB324C80E2DDD0DC
                                                                                                                                                                                                                                                SHA-256:96B510AF9B8C6BC1DFA84E9ED5E072F3FD484EEB66BBEBC7B6826ED859ED9027
                                                                                                                                                                                                                                                SHA-512:061FECE3C750C0229638DD8AF38FB3E8E48E59E0DE1B13BCFE46483A7A170B71B9BCB0D6F110B6B2EF68510FA940F9066F14CBD59829E222D6644D3657CE1893
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtau) {.. {-9223372036854775808 12064 0 LMT}.. {-1441164064 14400 0 +04}.. {-1247544000 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {7647156

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Aqtobe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1666
                                                                                                                                                                                                                                                Entropy (8bit):3.721746335201775
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5FUvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQR:PwaBNKs6b03zB0WJEuDa7sFZiKWaN6Tt
                                                                                                                                                                                                                                                MD5:E278B985BD2515DBCAED8CB741BE9208
                                                                                                                                                                                                                                                SHA1:BC9F5E72C430661D7ED1AF04571CE5D0F73DD18D
                                                                                                                                                                                                                                                SHA-256:991638FA2AB2A2F7A091A23D78D99306EE73A740F1A03FBAC448EDCAB55A0E38
                                                                                                                                                                                                                                                SHA-512:9951DB729B837647CC4B3D2E605525DCCBAFFD39D76460331BF62235DCAE5E4470CDA578F940B1739AABFEC55D293FF60D79AE0EFDFE1EB64E84571881FDEA6A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtobe) {.. {-9223372036854775808 13720 0 LMT}.. {-1441165720 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Ashgabat

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):878
                                                                                                                                                                                                                                                Entropy (8bit):3.937249024843323
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5ggeRMdIQvNcDvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKTob3CGcr:5gbkvNSvNhQQvmRKqv0fvzQIovWdvEGD
                                                                                                                                                                                                                                                MD5:259179C7A1CA04F9F3A373B6C8FCB8C5
                                                                                                                                                                                                                                                SHA1:D042DF8EFD8EC1473B45B1131BD5EB714F1B2C17
                                                                                                                                                                                                                                                SHA-256:13745BFA25E6E2D8D0FABAE42CB7C37CF9F974CFB343D4FE84E4E2D64A25926B
                                                                                                                                                                                                                                                SHA-512:703BEAD5A1E5B3816D98057A08A87C2139F418787F38561FE35175B84E2005365727F85D1B949CC5DF464B207A7D01BB65FB1A632E73DDA523E843B82D76FBBD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ashgabat) {.. {-9223372036854775808 14012 0 LMT}.. {-1441166012 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +05}.. {370720800 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Ashkhabad

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.801820439218014
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8xEYM4DyXHAIgN/ZEYovFvWARL/2WFKUNSH+WFKYEQ:SlSWB9vsM3yR+HAIgH8VWAN/2wKUNSeq
                                                                                                                                                                                                                                                MD5:5193EF7ADB646798801245BC50C8DDA6
                                                                                                                                                                                                                                                SHA1:83ED851CBC60EFB330A8FC119E1BED5B4C0BA630
                                                                                                                                                                                                                                                SHA-256:2C752F641B98E3C05B14AE31330D1F198DAA4A7E354BA9670C7754926BFB891A
                                                                                                                                                                                                                                                SHA-512:E940E1BE67A9AC895F3D060B1CB34797A429147A9DC2AC0F1162D37D86661EF217EDABA720F0AE3796186FE801229210AC785BB4511CBBE5A41791D236101D8C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ashgabat)]} {.. LoadTimeZoneFile Asia/Ashgabat..}..set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Atyrau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1666
                                                                                                                                                                                                                                                Entropy (8bit):3.7265766742957402
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:55TvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQJ:XrFBNKs6b03zB0WJEuDa7sFZiKWaN6Tl
                                                                                                                                                                                                                                                MD5:0236793F90ABC6F68718DDBB44AF5E2F
                                                                                                                                                                                                                                                SHA1:A5EFAEEF9B9159E748A3FED231F8A978E400482E
                                                                                                                                                                                                                                                SHA-256:4B7B118E6AE72D41740CF0CB2BD8E970700758DCBC0DD6F298199D841DF8408E
                                                                                                                                                                                                                                                SHA-512:851C7A9C110790454312BB9C5B5D3C426365EEF4673191B9ABB2E4A32301894C5FB1ADCBE2A4C67BEE416AD63FB8BED85F94EF9BF42473DA4BFFA7824935A1D5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Atyrau) {.. {-9223372036854775808 12464 0 LMT}.. {-1441164464 10800 0 +03}.. {-1247540400 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764715

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Baghdad

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1702
                                                                                                                                                                                                                                                Entropy (8bit):3.7261419515679393
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5/eVvyGiHD6UC4UrUomFMmUZcjbUKNFcUEUvUOpU8MYUWCUlbf/U9bUiUUybUQUF:5m8G9mFdnNF1FfsTuvQXHCe
                                                                                                                                                                                                                                                MD5:690013310A46BD1AE250A5E019353809
                                                                                                                                                                                                                                                SHA1:0DF434C7EEB707DC071007FAB112F4DEB37E936F
                                                                                                                                                                                                                                                SHA-256:D20B75D2604C3B742C1629C5EE02CFF6783E472249982B272B68F2A6DE9BDC38
                                                                                                                                                                                                                                                SHA-512:FF8C33E55E4F006C38D3FD37A1AD3E1200718CA374ECBEAE8255C7635912F0BB23A59A600BF7130D5660A24C515F726E8440D0D908E560CB59F74059638E6AA2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baghdad) {.. {-9223372036854775808 10660 0 LMT}.. {-2524532260 10656 0 BMT}.. {-1641005856 10800 0 +03}.. {389048400 14400 0 +03}.. {402264000 10800 0 +03}.. {417906000 14400 1 +03}.. {433800000 10800 0 +03}.. {449614800 14400 1 +03}.. {465422400 10800 0 +03}.. {481150800 14400 1 +03}.. {496792800 10800 0 +03}.. {512517600 14400 1 +03}.. {528242400 10800 0 +03}.. {543967200 14400 1 +03}.. {559692000 10800 0 +03}.. {575416800 14400 1 +03}.. {591141600 10800 0 +03}.. {606866400 14400 1 +03}.. {622591200 10800 0 +03}.. {638316000 14400 1 +03}.. {654645600 10800 0 +03}.. {670464000 14400 1 +03}.. {686275200 10800 0 +03}.. {702086400 14400 1 +03}.. {717897600 10800 0 +03}.. {733622400 14400 1 +03}.. {749433600 10800 0 +03}.. {765158400 14400 1 +03}.. {780969600 10800 0 +03}.. {796694400 14400 1 +03}.. {812505600 10800 0 +03}.. {82831

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Bahrain

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):171
                                                                                                                                                                                                                                                Entropy (8bit):4.784355129067593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8hkXHAIgNvZORL/2WFKENUKMFB/4WFKKB:SlSWB9vsM3yBkHAIgPON/2wKENUr/4wT
                                                                                                                                                                                                                                                MD5:1B5E0D449DAEF469D586A853CB3073AD
                                                                                                                                                                                                                                                SHA1:FD735B0472B31644E787767B82B737CC39EC4175
                                                                                                                                                                                                                                                SHA-256:3D437037FBF2BBDF969C8E71967080947F24860D431B39F5D8F23151316ABCD5
                                                                                                                                                                                                                                                SHA-512:2A2DC33D4258A5E1AE59172883F3B11723798ED35CF5AF1B8BA81A8807DC6F8222C8044D82B152EF6AF43E7350FEB2625D4406C6C7DD309CE65810EA3D3286B6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Qatar)]} {.. LoadTimeZoneFile Asia/Qatar..}..set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Baku

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2149
                                                                                                                                                                                                                                                Entropy (8bit):3.6155622322573713
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5/eFdqlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUTIEjvZJ+76:5RsUf8mFpNWFny1ZGMte3aivUKo
                                                                                                                                                                                                                                                MD5:294DFC98F67AC00A188EC3D3B87C501C
                                                                                                                                                                                                                                                SHA1:93C434CD9AA170E35AD676C88EE09986A94EC02A
                                                                                                                                                                                                                                                SHA-256:873E8F08B87610D0DAFE239D32345248A4595C6B13D1DA83EC214D78E88FA12C
                                                                                                                                                                                                                                                SHA-512:5346082CCA733724C0D2C36B768467E59BA9ED6452B6CF1BA923AF4F0D2BC05C67DB49E804CA81DAD449D30D0835026D708D9AB632D02FDA1EA1A0BF717111DE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baku) {.. {-9223372036854775808 11964 0 LMT}.. {-1441163964 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 14400 0 +04}.. {820440000 14400 0 +04}.. {828234000 18000 1 +05}.. {846378000 14400 0 +04}.. {852062400

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Bangkok

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.911309754748998
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFKELYOiMXGm2OHB+keoHvZKmrROpDovFFsQ+8EXVeVSYe:SlSWB9eg/2wKELeDm2OHxeoHvZ3FO1og
                                                                                                                                                                                                                                                MD5:9AC4947AC29C797055B7EBFA4F6AC710
                                                                                                                                                                                                                                                SHA1:E7758A9A8BFA255F6B2D27F5366D9FE2A26DDF6C
                                                                                                                                                                                                                                                SHA-256:6E72BA908F250FD45D554A12E3E7B3BD2F1C02A6C2431F806FD2A054F843AA90
                                                                                                                                                                                                                                                SHA-512:F9D0F0CB7D3726C2AB3B5049429172D9DD4BA21353F6F98570CBA4EE969F7D97BD973CB165AECFF930AFFA8633E8052624D44EE7FB91763681ED3F78A61F4F98
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bangkok) {.. {-9223372036854775808 24124 0 LMT}.. {-2840164924 24124 0 BMT}.. {-1570084924 25200 0 +07}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Barnaul

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2117
                                                                                                                                                                                                                                                Entropy (8bit):3.7025684250364725
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5VeTtXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEnsr:5n40yVRB7VfXucdKmtTTDOV
                                                                                                                                                                                                                                                MD5:6CC13B6910412A3A3D16CA36ADF00352
                                                                                                                                                                                                                                                SHA1:061CF4A8FEA8C139F50F96E6B6506B50ED3DD792
                                                                                                                                                                                                                                                SHA-256:992F93A7975F8CD4E94D96B3BA1ECFB3585E52A53F4442A15993402D3F955F66
                                                                                                                                                                                                                                                SHA-512:4E9750B1C3C0BA4F7922BCBC76276A3E74031D78A98E21DC59F66D6EA8E1B70865BBEB50A6B77EB0423421A18428B97B47412053CE15213128CEED669F4DD6E8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Barnaul) {.. {-9223372036854775808 20100 0 LMT}.. {-1579844100 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {76470

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Beirut

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8024
                                                                                                                                                                                                                                                Entropy (8bit):3.7230911686481774
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:4nBKPP8LFH0TDkywaZb1QSCK5VUjiO1PoBQpo7778CZicJZS80EGcLt4Mok1MgJl:4M38LCRZb+sAiO1PoBQpo1ikjD
                                                                                                                                                                                                                                                MD5:1D99E2BBB01B1669403CFBAF7E03F733
                                                                                                                                                                                                                                                SHA1:DBDD58C7FD195FC602C4541D6F416CC96094C121
                                                                                                                                                                                                                                                SHA-256:17AF14646D562AFE17DCCFD1D2FBA95C122F3E0263906A36EB48BFF04ACF233E
                                                                                                                                                                                                                                                SHA-512:98524E8DCD17C090058F17BDA1200D9801EB1B14EB5CEB8C31149A4A402A53BA4923A2AFF457E0A72DAA601D88095247806F945F704000F874FCBF73631DD135
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Beirut) {.. {-9223372036854775808 8520 0 LMT}.. {-2840149320 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1473645600 10800 1 EEST}.. {-1460948400 7200 0 EET}.. {-399866400 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336794400 10800 1 EEST}.. {-323578800 7200 0 EET}.. {-305172000 10800 1 EEST}.. {-291956400 7200 0 EET}.. {-273636000 10800 1 EEST}.. {-260420400 7200 0 EET}.. {78012000 10800 1 EEST}.. {86734800 7200 0 EET}.. {105055200 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {212965200 7200 0 EET}.. {231285600 10800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Bishkek

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1669
                                                                                                                                                                                                                                                Entropy (8bit):3.7443715330695735
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5qvdJqxiF0rvK5XvV4vUzvCjvT7voPvkPvJUbvn0vYpv99v3uvuWvKJhv3T:Ad1mzK5/VkULCbTjoHkHJUDnQYV9p3mO
                                                                                                                                                                                                                                                MD5:1EE8FF3DF0D931A140ADBB021EB3BFEB
                                                                                                                                                                                                                                                SHA1:F1F15EF70C4E9F456849AF89CAC97AD747D9E192
                                                                                                                                                                                                                                                SHA-256:1D5E9A8F6A04273AF741F648EF10718B004A60D7884FE432DDF85A8F558BEA98
                                                                                                                                                                                                                                                SHA-512:155539A5CF21A34FBFACBF1652D934BF32255F4E505E60B3B4D8B5F2F7FAE552E6CB4824D8608A9C56370F58E48702335995BBD16B7A296A86A72A615FBC8ABC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bishkek) {.. {-9223372036854775808 17904 0 LMT}.. {-1441169904 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {683586000 18000 0 +05}.. {703018800 21600 1 +05}.. {717530400 18000 0 +05}.. {734468400 21600 1 +05}.. {748980000 18000 0 +05}.. {765918000 21600 1 +05}.. {78042

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Brunei

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.949517569857329
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8kLP/vXHAIgN16L1RL/2WFKXeAMM7QWFKPLPyn:SlSWB9vsM3yELPHAIg+L1N/2wK0oQwKW
                                                                                                                                                                                                                                                MD5:716D842F23974137C5E07A1A65CEFC5D
                                                                                                                                                                                                                                                SHA1:C7248C9DBD6AE5AF33BD4B3602D17737EBE023A0
                                                                                                                                                                                                                                                SHA-256:F3110E9DD514E3654A9DE777E22B2D2391692927954B4B7E42ED54AB665C3CF5
                                                                                                                                                                                                                                                SHA-512:4EC012EAABE60728D9447EEDF4BA7B16CA82786AA39EE79B2F9B32F227F9816FCE42F173153261F9AF88A12209752E84EBD7170C54D126C2DBB1ED3A8D069668
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kuching)]} {.. LoadTimeZoneFile Asia/Kuching..}..set TZData(:Asia/Brunei) $TZData(:Asia/Kuching)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Calcutta

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.774027471796823
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq864DyXHAIgN1QvRL/2WFKh0s+WFKvovn:SlSWB9vsM3ya4DSHAIgcvN/2wKN+wKvy
                                                                                                                                                                                                                                                MD5:8BB098AB77CB0469B1FA0E0B64C4A9E7
                                                                                                                                                                                                                                                SHA1:88C73626985071DD0923E1CAB343ACCD854A7297
                                                                                                                                                                                                                                                SHA-256:1BAEF7850111D2C33B2A766A8AE804534ABA1711BF80A4087A89656DDD8469D5
                                                                                                                                                                                                                                                SHA-512:82216A7F787AF20A4C97C7AA754CD6BE979FEF24137CF9A8B18EECA5E8FBCF12834DD8A6FC9CD2357D807F1629806745B46B11DC0472E0284E18DCCC983897DE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kolkata)]} {.. LoadTimeZoneFile Asia/Kolkata..}..set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Chita

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2086
                                                                                                                                                                                                                                                Entropy (8bit):3.6981807774781017
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5Bpr1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2M:95PhtjLiII2ZFlgd
                                                                                                                                                                                                                                                MD5:69E03A5CEB689E19B60168C0F7EBAE8E
                                                                                                                                                                                                                                                SHA1:95C6396EB753753B4FE4AE1B98D76332523E72A4
                                                                                                                                                                                                                                                SHA-256:10B6F435B05D887176A4D90CA5AC957F327F62F36F15D6F6E4F81844662429B9
                                                                                                                                                                                                                                                SHA-512:DFA72EDC54A11F0840ADBEE7F5AD8EA472AA52A1F196292F1341CD92A68FB2EC0A5BC7DE6C8E83C975420DB4B76CECD4393370FDB2C09F86EC11A50E540F6F02
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Chita) {.. {-9223372036854775808 27232 0 LMT}.. {-1579419232 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647012

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Choibalsan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1619
                                                                                                                                                                                                                                                Entropy (8bit):3.775783980828041
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5th5fSW2sp4Qh2rRSQnGw7GywvWbC25XrMYWG4AIQTUhp9pkTGdXguHaena44XY5:rh5kpmWG29QFUmD
                                                                                                                                                                                                                                                MD5:540A7304A62ABB8D7F84454ABD6E2556
                                                                                                                                                                                                                                                SHA1:52C37529929218A668D7A4AD6FD1B5FE0A727E16
                                                                                                                                                                                                                                                SHA-256:94B2C14EF45C695EF6B19D94722E1BCBB629A595F2866DBA80F00A66721040B5
                                                                                                                                                                                                                                                SHA-512:3B535D109DB369E301D6B412F21EC990976B997826F22B2E16ECEEEB048D60F064C7CA1A616393DC2F1B491BAC0548DC0965B9EA149A95280FFDBCAD6726EF0F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Choibalsan) {.. {-9223372036854775808 27480 0 LMT}.. {-2032933080 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 36000 0 +09}.. {433778400 32400 0 +09}.. {449593200 36000 1 +09}.. {465314400 32400 0 +09}.. {481042800 36000 1 +09}.. {496764000 32400 0 +09}.. {512492400 36000 1 +09}.. {528213600 32400 0 +09}.. {543942000 36000 1 +09}.. {559663200 32400 0 +09}.. {575391600 36000 1 +09}.. {591112800 32400 0 +09}.. {606841200 36000 1 +09}.. {622562400 32400 0 +09}.. {638290800 36000 1 +09}.. {654616800 32400 0 +09}.. {670345200 36000 1 +09}.. {686066400 32400 0 +09}.. {701794800 36000 1 +09}.. {717516000 32400 0 +09}.. {733244400 36000 1 +09}.. {748965600 32400 0 +09}.. {764694000 36000 1 +09}.. {780415200 32400 0 +09}.. {796143600 36000 1 +09}.. {811864800 32400 0 +09}.. {828198000 36000 1 +09}.. {843919200 32400 0 +09}.. {8596

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Chongqing

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.865222436335267
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKh2V7/4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKho4wKU
                                                                                                                                                                                                                                                MD5:C5DC40C6325391F7247251ADB2C07F78
                                                                                                                                                                                                                                                SHA1:3DDB1BF94532FB1F1271095B9C8CAA779BC545EF
                                                                                                                                                                                                                                                SHA-256:A87382DC5F3C3141547A65E3746AF1DAF94B51468B96DA6CEF30E95754C97D37
                                                                                                                                                                                                                                                SHA-512:062FF8D5E5392E5372B0405EDF3C7CF997AC33F95EBFFAA9CC9AB82BBE27B60C80255FCCEE9E6F5E02CBFCB163F99984BB2103217FFD1F80BDEC5C684BF2F61A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Chungking

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.889115378893491
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFK7LeL9J4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wK7LUT4wj
                                                                                                                                                                                                                                                MD5:C3676771EB813B346F58A7B574D0D7B5
                                                                                                                                                                                                                                                SHA1:A473EF621309E019F29F3DEF95C38593775B8404
                                                                                                                                                                                                                                                SHA-256:D6D2B4A761C547F1F853AE901AC71AB49FBE825037079C4E0C89DC940AE4A822
                                                                                                                                                                                                                                                SHA-512:21C3A5D499E6E0427FBF585CA8CC5D99D193C586483AB107C4D8E9F9DC8412021E8E019A314757DAFE1225D2635F6D48E9C54A511709863F22A02449FA201E02
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Colombo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):369
                                                                                                                                                                                                                                                Entropy (8bit):4.465596050904646
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKr+iDm2OHgoHvZv9tdvjSWV/FSQipPUrKkTD/k5QqRVVFSQOR/UIp:MB862zZmdHgCvZvJvj1Nj+Phkv/YtvjA
                                                                                                                                                                                                                                                MD5:9541BB43E79AB0C6E8163945B5BFB1BF
                                                                                                                                                                                                                                                SHA1:C4994420DB8313DECDE19B4B9F6C5DB0126A95A7
                                                                                                                                                                                                                                                SHA-256:E5B5E6D607A15DA65CB00C92C35A63EAF25F547E64CB34BB419CB8CFC2714B1B
                                                                                                                                                                                                                                                SHA-512:46F623B3F7CF8A50F97DD812521398EB9100C9CDFB967C18EF1BD112306AAEB3C9CB224424E48611CB8CC21D1DC3D820DD83032D12BC9DF19301CF07786FA664
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Colombo) {.. {-9223372036854775808 19164 0 LMT}.. {-2840159964 19172 0 MMT}.. {-2019705572 19800 0 +0530}.. {-883287000 21600 1 +06}.. {-862639200 23400 1 +0630}.. {-764051400 19800 0 +0530}.. {832962600 23400 0 +0630}.. {846266400 21600 0 +06}.. {1145039400 19800 0 +0530}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Dacca

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):169
                                                                                                                                                                                                                                                Entropy (8bit):4.786111096226559
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8ntyXHAIgN6KyFvRL/2WFK1S2WFKwBn:SlSWB9vsM3yHtSHAIgMKON/2wKM2wKwB
                                                                                                                                                                                                                                                MD5:BA575D37459540907A644438071277F8
                                                                                                                                                                                                                                                SHA1:14CF10D6AABBAF7BAE42B3B9641D8469C206567F
                                                                                                                                                                                                                                                SHA-256:B3AD560F66EA330E54A147017E6E6AB64452A5255D097B962D540836D7B19EE7
                                                                                                                                                                                                                                                SHA-512:9CA386EF4D812B00C2E63558B81B273F92BBCA98AF304C9FD6FC166210FC4E2F92B769E1D6FB96B670650DC76EFFAD2FC6E39AE12C24B47EAED4E50A2AFAC2D7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dhaka)]} {.. LoadTimeZoneFile Asia/Dhaka..}..set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Damascus

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3692
                                                                                                                                                                                                                                                Entropy (8bit):3.7832279883701254
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:59xu6+RYla5W87rtYV08a7bd+dYV004X7JkX3Q0dzPeP2ua/XAog7jP/xZsNaTvT:8YI5WpVAdVGlkBOLh8X0CkBheIFlR
                                                                                                                                                                                                                                                MD5:1D6B2CC38669C0F7378D9A576F10C477
                                                                                                                                                                                                                                                SHA1:09A31E6295D9FC39219DFA4FC598B46F55C41180
                                                                                                                                                                                                                                                SHA-256:7E577F0F9DA459BA1A325BE95C1FA0DB2C6ECFC1D64CDB73F3ADB09588293BA7
                                                                                                                                                                                                                                                SHA-512:A0BBD5CE7883C275BF9752C75BA0C9AF0181046D94D27EFC96EC8823C374BADCB69B2B11D2C4497295E5BC25D5790634C69C6E7185F406F2107A8E16044E670F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Damascus) {.. {-9223372036854775808 8712 0 LMT}.. {-1577931912 7200 0 EET}.. {-1568592000 10800 1 EEST}.. {-1554080400 7200 0 EET}.. {-1537142400 10800 1 EEST}.. {-1522630800 7200 0 EET}.. {-1505692800 10800 1 EEST}.. {-1491181200 7200 0 EET}.. {-1474243200 10800 1 EEST}.. {-1459126800 7200 0 EET}.. {-242265600 10800 1 EEST}.. {-228877200 7200 0 EET}.. {-210556800 10800 1 EEST}.. {-197427600 7200 0 EET}.. {-178934400 10800 1 EEST}.. {-165718800 7200 0 EET}.. {-147398400 10800 1 EEST}.. {-134269200 7200 0 EET}.. {-116467200 10800 1 EEST}.. {-102646800 7200 0 EET}.. {-84326400 10800 1 EEST}.. {-71110800 7200 0 EET}.. {-52704000 10800 1 EEST}.. {-39488400 7200 0 EET}.. {-21168000 10800 1 EEST}.. {-7952400 7200 0 EET}.. {10368000 10800 1 EEST}.. {23583600 7200 0 EET}.. {41904000 10800 1 EEST}.. {55119600 7200 0 EET}.. {73526400 10800 1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Dhaka

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):364
                                                                                                                                                                                                                                                Entropy (8bit):4.412125512631861
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKwiDm2OHEmVFnoHv9vX+Yl7UIFckVVFSQiL/FG/UIvy/Ur9i/Ur97:MB862Y2mdHzdCv9P+Y9vvjeQlP9/9VkK
                                                                                                                                                                                                                                                MD5:B5496A038AC230B9D75AA22BB2BE6BDD
                                                                                                                                                                                                                                                SHA1:ACFD9C78F803F344272E8E188C41ED969EBADA16
                                                                                                                                                                                                                                                SHA-256:BFC4562055CC4355E79F9EFAA580A4C6A658285916159A5D390A0CDA96A97E98
                                                                                                                                                                                                                                                SHA-512:AB05D0176DADC1ED03CC526C372B9827A5FA03459E4F4B4365C6CE4B6FBDA043514A9D3FE2DA747159C5A1BC0E07727E6578A101E42B4DB120AF9624368C5FEA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dhaka) {.. {-9223372036854775808 21700 0 LMT}.. {-2524543300 21200 0 HMT}.. {-891582800 23400 0 +0630}.. {-872058600 19800 0 +0530}.. {-862637400 23400 0 +0630}.. {-576138600 21600 0 +06}.. {1230746400 21600 0 +06}.. {1245430800 25200 1 +06}.. {1262278800 21600 0 +06}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Dili

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):235
                                                                                                                                                                                                                                                Entropy (8bit):4.597480383845617
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKCXeSDm2OHnBGeoH1mpvyvScHTU71avScr:MB862qXbmdHnBvC1SyHHq8Hr
                                                                                                                                                                                                                                                MD5:316DDF860FA234621698EB473E558DB7
                                                                                                                                                                                                                                                SHA1:35BF955F764555945CF8B314B8E881DAD6CF557B
                                                                                                                                                                                                                                                SHA-256:8BC2E0D77AC35B6D63E11B820AC45EC23A4195ED773680C600C772FDF4B953F8
                                                                                                                                                                                                                                                SHA-512:D1A8D5F1DAAB7827BDCBC14506AF8681FD1ED94C6101CC4A3C8CC2A76EA7D3649038069158C539A2007A1B0734FBD87DE120415E07A3F08F44417100C95459F5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dili) {.. {-9223372036854775808 30140 0 LMT}.. {-1830414140 28800 0 +08}.. {-879152400 32400 0 +09}.. {199897200 28800 0 +08}.. {969120000 32400 0 +09}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Dubai

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):148
                                                                                                                                                                                                                                                Entropy (8bit):4.97292023820863
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFKQUMXGm2OHvkdoHsQK23NVsRYovV:SlSWB9eg/2wKQUDm2OHvsoHxVNSN
                                                                                                                                                                                                                                                MD5:861BA4A0A71E6C3F71B90074275FD57C
                                                                                                                                                                                                                                                SHA1:BC6FC5233340BB19AE4BD0BA563875479AC0A2B9
                                                                                                                                                                                                                                                SHA-256:3DB174F1568BC23BF467A3DC7BAF8A2A2952B70653D4DE54F4DB391EC50B6925
                                                                                                                                                                                                                                                SHA-512:B187735E0783F299253D9F93E002AEFF131FCCA50FB3E04CF0545B334B051D5ED978108A47C6957B608F5F93ED4CC3D69751FE0F40413719EE1C0440CD49AC76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dubai) {.. {-9223372036854775808 13272 0 LMT}.. {-1577936472 14400 0 +04}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Dushanbe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):820
                                                                                                                                                                                                                                                Entropy (8bit):3.969189280047274
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5we3dJvOt81FCuLqecDngO6jPvTpYy5T4TiFGDr:5BvdJqxiF0uGr
                                                                                                                                                                                                                                                MD5:9ABD0ECB5F3E738F49CDD1F81C9FF1A4
                                                                                                                                                                                                                                                SHA1:46B68C7BBD1BE9791B00128A5129AA3668435C93
                                                                                                                                                                                                                                                SHA-256:550DB44595F59D0F151BE4AF70D6FECE20580AB687EF45DE2A0A75FB2515AC80
                                                                                                                                                                                                                                                SHA-512:67E2B0EF216D509C4B6DD367519E0A733E54A7CA767D5F7960715E8056E61B7B633C7516D568544F55C9277E90412C1443B822C6EED3341C01F1BD9AA9476FA1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dushanbe) {.. {-9223372036854775808 16512 0 LMT}.. {-1441168512 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 21600 1 +06}.. {684363600 18000 0 +05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Famagusta

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7597
                                                                                                                                                                                                                                                Entropy (8bit):3.7170041442081203
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:G3pv/7V6Aj8aZaNlK0UpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:G3v/AaaivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:F8E4BA3E260452AE13CF234E60149A62
                                                                                                                                                                                                                                                SHA1:8DDB08E2FDEEF6539EE0C0038B166908BFED16CD
                                                                                                                                                                                                                                                SHA-256:8CFE85C48FC22033411432F8B75EE4C097A5D84897698CB1AFD5AB51C47FF5A3
                                                                                                                                                                                                                                                SHA-512:487177411FB7E9F83AB9AAD84B685322B13A85784D4F90BB9C30F57BFAA6A9298E5C4F36C97444DE1117E51F85A62DC639D08B405460D071C2B29C898553E9A3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Famagusta) {.. {-9223372036854775808 8148 0 LMT}.. {-1518920148 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {622587

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Gaza

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8427
                                                                                                                                                                                                                                                Entropy (8bit):3.7494839792487094
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:NyHSd2XK1GbJFp3gP0nPVl8dcqU/8O8pc1FoMpQ2NpPfM2g1siiVVfIsuDzhsXaP:NyyIgGbJv3dPAD7c1FoMpHu3Ky3p
                                                                                                                                                                                                                                                MD5:DEB2D261D6885CD83054391D010DE6AD
                                                                                                                                                                                                                                                SHA1:5779B343F4EB2BC75613C593E2FA3A026857F940
                                                                                                                                                                                                                                                SHA-256:A1823EDA63434ACF1A37B3A781A783CFEB6BB4CC53ED0469BB685834837F2289
                                                                                                                                                                                                                                                SHA-512:D024B2D324D981A6792127551B0D466EAFFC5294C84CB5752A71E5267FB2E9162E7EFAED5A5CA3B06BBAD285F62BF955B0EF86DD39307EE5F935FC601F4EEEFA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Gaza) {.. {-9223372036854775808 8272 0 LMT}.. {-2185409872 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-16580

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Harbin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.86422571961583
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKwHp4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKi4wKU
                                                                                                                                                                                                                                                MD5:1BCCB3578FADE993EE8B2C11EAC06CD8
                                                                                                                                                                                                                                                SHA1:CAEAB714E014CD5040C44E4603708B97BC0B03D4
                                                                                                                                                                                                                                                SHA-256:12811A7944B892E3D1C0B4B09057CC1899F28081B3CD47FFD248BA49BA308AF0
                                                                                                                                                                                                                                                SHA-512:1D791DC0E8F45359366DF33C2C337688D2E0E972A90F038733B840D28585505AEF542DDBAD014C9EA8C252048A588CD017DD67A84545A81EDB7C17E3B2E65092
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Hebron

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8402
                                                                                                                                                                                                                                                Entropy (8bit):3.7520828858184325
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:fXSd2XK1GbJFp3gP0nPVl8dcqUZ8O8pc1FoMpQ2NpPfM2g1siiVVfIsuDzhsXa4a:fiIgGbJv3dPADPc1FoMpHu3Ky3p
                                                                                                                                                                                                                                                MD5:6F176787C7FC5764A63719F0041690BA
                                                                                                                                                                                                                                                SHA1:C292A8CEA597D7FD9E2D071AB7AE93E7ABCA21A5
                                                                                                                                                                                                                                                SHA-256:732CAA355542C8781C61FC8F5265EBFC59C8CC24E78D01011E1E3256E6B34DC7
                                                                                                                                                                                                                                                SHA-512:EE8F39A3D65D75E14B59B4D9CCB27894210CA269E82A7AC7F98BE67764688A8895EBB9C1ACEAB4C1B368B4F1BC5AFCB34E8866CEDFD91232926DF47517096513
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hebron) {.. {-9223372036854775808 8423 0 LMT}.. {-2185410023 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Ho_Chi_Minh

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):395
                                                                                                                                                                                                                                                Entropy (8bit):4.431055857167822
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862RLmdHneCvhYC5sF/p+zHHviViksF/dMUYPsF/RQ9EsV:5de3vhd5sFR+znv2vsFlM/PsFVsV
                                                                                                                                                                                                                                                MD5:A49A3D55C1E10A37125C51F9C6363868
                                                                                                                                                                                                                                                SHA1:7C1B5D44643ADC3F02681F6379E82C3F4512F0C1
                                                                                                                                                                                                                                                SHA-256:D8A19C70BE5A9AE1E6091DC8FD03D7719110D1F3D78786C91D5BD0949FB5A428
                                                                                                                                                                                                                                                SHA-512:804C44E51BB9E93B156B0CB4CB125651003B3C42D65334A052BE149734221315CC75D4FBDE34F62DFC102F1A9C968D1C9B573839C7ECBF7397B61BD90E530B20
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ho_Chi_Minh) {.. {-9223372036854775808 25590 0 LMT}.. {-2004073590 25590 0 PLMT}.. {-1851577590 25200 0 +07}.. {-852105600 28800 0 +08}.. {-782643600 32400 0 +09}.. {-767869200 25200 0 +07}.. {-718095600 28800 0 +08}.. {-457776000 25200 0 +07}.. {-315648000 28800 0 +08}.. {171820800 25200 0 +07}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Hong_Kong

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2226
                                                                                                                                                                                                                                                Entropy (8bit):4.0055033036300145
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5Ze9l9Pm4yoHtTYJJIX1Zcp6GS0j1SPQpP6gPE8fTZIPNYQGm75st/nQdwi9:DyaoTcwQt6EsQTng
                                                                                                                                                                                                                                                MD5:26BCBBA28AE34FE3CF7D17EF4C6B69C8
                                                                                                                                                                                                                                                SHA1:5324DEA8E7965C66650E7B4769EFA1297B508486
                                                                                                                                                                                                                                                SHA-256:EE9A6997BC1AAD4A8FA95DB312774C3F37FBB895549230C30FC66C02CC170EB6
                                                                                                                                                                                                                                                SHA-512:54594CD18838B4A8947EBB5BDE2415727CC127CF79AEC98FC0F5D5A32F68EEAF4E079853239DE9F753CE90F18EFD55AE51FC43D64E313666CEA0EF8AC93BF065
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hong_Kong) {.. {-9223372036854775808 27402 0 LMT}.. {-2056690800 28800 0 HKT}.. {-900910800 32400 1 HKST}.. {-891579600 30600 1 HKWT}.. {-884248200 32400 0 JST}.. {-761209200 28800 0 HKT}.. {-747907200 32400 1 HKST}.. {-728541000 28800 0 HKT}.. {-717049800 32400 1 HKST}.. {-697091400 28800 0 HKT}.. {-683785800 32400 1 HKST}.. {-668061000 28800 0 HKT}.. {-654755400 32400 1 HKST}.. {-636611400 28800 0 HKT}.. {-623305800 32400 1 HKST}.. {-605161800 28800 0 HKT}.. {-591856200 32400 1 HKST}.. {-573712200 28800 0 HKT}.. {-559801800 32400 1 HKST}.. {-541657800 28800 0 HKT}.. {-528352200 32400 1 HKST}.. {-510211800 28800 0 HKT}.. {-498112200 32400 1 HKST}.. {-478762200 28800 0 HKT}.. {-466662600 32400 1 HKST}.. {-446707800 28800 0 HKT}.. {-435213000 32400 1 HKST}.. {-415258200 28800 0 HKT}.. {-403158600 32400 1 HKST}.. {-383808600 28800 0 HKT

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Hovd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1583
                                                                                                                                                                                                                                                Entropy (8bit):3.7521760184466206
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5x3LecCvgsFFFKOksF8FpsF71FQnsFNFxhsFlF6sFaFasFZFisF8GF5sFKLFAZsZ:5FqKVx8Cq9f/y2L
                                                                                                                                                                                                                                                MD5:A77140A0D8C2D3E2993E4BA7CADFB4C6
                                                                                                                                                                                                                                                SHA1:AE3586264A86D42F578D4B0F7A30C9BE6047EAB1
                                                                                                                                                                                                                                                SHA-256:CA88A45E954A9854C680B399E69E4858BF5E861FABFADC19D62D97B734B25415
                                                                                                                                                                                                                                                SHA-512:05EA9D903EEC755F799B7C2399ED933245A5AE3A594648FE37AF1CE7699AE499B4ED159F428D91259D80BC9AF5117F2DA055A506AED94E5281C38B7AFF69C6FE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hovd) {.. {-9223372036854775808 21996 0 LMT}.. {-2032927596 21600 0 +06}.. {252439200 25200 0 +07}.. {417978000 28800 1 +07}.. {433785600 25200 0 +07}.. {449600400 28800 1 +07}.. {465321600 25200 0 +07}.. {481050000 28800 1 +07}.. {496771200 25200 0 +07}.. {512499600 28800 1 +07}.. {528220800 25200 0 +07}.. {543949200 28800 1 +07}.. {559670400 25200 0 +07}.. {575398800 28800 1 +07}.. {591120000 25200 0 +07}.. {606848400 28800 1 +07}.. {622569600 25200 0 +07}.. {638298000 28800 1 +07}.. {654624000 25200 0 +07}.. {670352400 28800 1 +07}.. {686073600 25200 0 +07}.. {701802000 28800 1 +07}.. {717523200 25200 0 +07}.. {733251600 28800 1 +07}.. {748972800 25200 0 +07}.. {764701200 28800 1 +07}.. {780422400 25200 0 +07}.. {796150800 28800 1 +07}.. {811872000 25200 0 +07}.. {828205200 28800 1 +07}.. {843926400 25200 0 +07}.. {859654800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Irkutsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2089
                                                                                                                                                                                                                                                Entropy (8bit):3.7296034934492694
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5PZy4DdOKStci4KjXoYjoSvfQJWE00dtT43kgiTskNrrBizhzRBqY3M:Py2/svfraBGfgP
                                                                                                                                                                                                                                                MD5:C9F7AC464970567E5C38CB01ED2297AE
                                                                                                                                                                                                                                                SHA1:453718BACCAE3FACD761AF22CA5875185478ADDD
                                                                                                                                                                                                                                                SHA-256:61BAAAD6315FFBDAED6F266880165B06ECCAF72F660B7FB01C8B654F3952D68E
                                                                                                                                                                                                                                                SHA-512:72044EFAE262CC12974F2DE2AAF06AC4C31BE73071ACD53DDC6B8D8BFC6FBDF937EC03DC881901F730659BDE662FBCFC76C57B2C086DAA97F160530464FBA7C6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Irkutsk) {.. {-9223372036854775808 25025 0 LMT}.. {-2840165825 25025 0 IMT}.. {-1575874625 25200 0 +07}.. {-1247554800 28800 0 +09}.. {354902400 32400 1 +09}.. {370710000 28800 0 +08}.. {386438400 32400 1 +09}.. {402246000 28800 0 +08}.. {417974400 32400 1 +09}.. {433782000 28800 0 +08}.. {449596800 32400 1 +09}.. {465328800 28800 0 +08}.. {481053600 32400 1 +09}.. {496778400 28800 0 +08}.. {512503200 32400 1 +09}.. {528228000 28800 0 +08}.. {543952800 32400 1 +09}.. {559677600 28800 0 +08}.. {575402400 32400 1 +09}.. {591127200 28800 0 +08}.. {606852000 32400 1 +09}.. {622576800 28800 0 +08}.. {638301600 32400 1 +09}.. {654631200 28800 0 +08}.. {670356000 25200 0 +08}.. {670359600 28800 1 +08}.. {686084400 25200 0 +07}.. {695761200 28800 0 +09}.. {701805600 32400 1 +09}.. {717530400 28800 0 +08}.. {733255200 32400 1 +09}.. {748

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Istanbul

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.9013773460609
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/2WFK4HB/8QaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/2wK4HJa
                                                                                                                                                                                                                                                MD5:8A92C690BE27A69D122BFF51479B7B56
                                                                                                                                                                                                                                                SHA1:52DB64587A347F34153A51788BDE8C349D966575
                                                                                                                                                                                                                                                SHA-256:1F77C4BD27574E1D2066885DEF01806A02D3E444424A219A8EC5C114F89665E5
                                                                                                                                                                                                                                                SHA-512:FEDF57C4862B6792A789F339EB1027EC8A8472B01B7D1D0814C419850B9AC03A7B454FDB04D8BECE166E9A8BCAA58B0B461007A6C824B30B1080991A1DB49CCA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Jakarta

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):370
                                                                                                                                                                                                                                                Entropy (8bit):4.4733192761103515
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKcrJfDm2OHATJeoHMaSYov/YSZkc5q/MVSSFFWSyvScH+dMVSSFL+:MB862EJLmdHjCEdOc5aMxaSyHHaMxF6P
                                                                                                                                                                                                                                                MD5:C689A1AA9FFE535AEB3AD3D7EDE55172
                                                                                                                                                                                                                                                SHA1:0520FC9A4619FB555A79C5DF2AE82422BF2C5EDA
                                                                                                                                                                                                                                                SHA-256:2F39D9F93761B85C254F458317A7DE2B4184BE9459F2193A85C08662E801269A
                                                                                                                                                                                                                                                SHA-512:C1034FB2FCFEF201C5362AF21B048B6637A824C5C93D75854CF3807892C772CD4376533E58BFF8D8726F531F43CB231365B8012EBD3C1BECED865D3CD2D6673D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jakarta) {.. {-9223372036854775808 25632 0 LMT}.. {-3231299232 25632 0 BMT}.. {-1451719200 26400 0 +0720}.. {-1172906400 27000 0 +0730}.. {-876641400 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 25200 0 WIB}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Jayapura

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):213
                                                                                                                                                                                                                                                Entropy (8bit):4.834345288972067
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKcaDm2OHG4YoH1kcfvScHVowkVcr2CV4zvhyov:MB862PmdHNYC6cfHHVop2NVkoov
                                                                                                                                                                                                                                                MD5:2CB3A13FCC48F8C4457E001FC309918B
                                                                                                                                                                                                                                                SHA1:83174176815CB93D216B5BC532C120EC8AC433CF
                                                                                                                                                                                                                                                SHA-256:761C1E80FEBF46D6D6215CEBF211F121974156D9BCE2FB4258C1074C6ED2CE22
                                                                                                                                                                                                                                                SHA-512:65009020AB9FEC2F8158A4851A78B71127F9B262DDD1472583942E19B7C086304F54BC8DAE5A40BD1448BCAEDA0FDBACCD19400E10FFA0357E324535F9036EF0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jayapura) {.. {-9223372036854775808 33768 0 LMT}.. {-1172913768 32400 0 +09}.. {-799491600 34200 0 +0930}.. {-189423000 32400 0 WIT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Jerusalem

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8135
                                                                                                                                                                                                                                                Entropy (8bit):3.770028446231146
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:GKfnxFAEX/nPVl8diAg9oEhH20AHz7LzdWhYbBJPXuVhKaM76Rmg4DLeEcNptv5C:7ffBvPAzF0AHzPzdD1+XBRF0
                                                                                                                                                                                                                                                MD5:884227D48C92BA6C519BFE571D4F1037
                                                                                                                                                                                                                                                SHA1:21F8977816C2B439686A50D353B836A6D132A946
                                                                                                                                                                                                                                                SHA-256:0BDC2C693134199C2ECD374CC01468813DB29DF47422C706A3EA2BE5ECCA177A
                                                                                                                                                                                                                                                SHA-512:8A09F1FE11DAD203501A16FE6A2CAEC969FE3553B456B8BD1997E55B3EE430B2BB4B54F7D87C5E99931FD96E7C769CAA618C777EBD23FBD1E1A0F57409422914
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jerusalem) {.. {-9223372036854775808 8454 0 LMT}.. {-2840149254 8440 0 JMT}.. {-1641003640 7200 0 IST}.. {-933638400 10800 1 IDT}.. {-923097600 7200 0 IST}.. {-919036800 10800 1 IDT}.. {-857347200 7200 0 IST}.. {-844300800 10800 1 IDT}.. {-825811200 7200 0 IST}.. {-812678400 10800 1 IDT}.. {-794188800 7200 0 IST}.. {-779846400 10800 1 IDT}.. {-762652800 7200 0 IST}.. {-748310400 10800 1 IDT}.. {-731116800 7200 0 IST}.. {-681955200 14400 1 IDDT}.. {-673228800 10800 1 IDT}.. {-667958400 7200 0 IST}.. {-652320000 10800 1 IDT}.. {-636422400 7200 0 IST}.. {-622080000 10800 1 IDT}.. {-608947200 7200 0 IST}.. {-591840000 10800 1 IDT}.. {-572486400 7200 0 IST}.. {-558576000 10800 1 IDT}.. {-542851200 7200 0 IST}.. {-527731200 10800 1 IDT}.. {-514425600 7200 0 IST}.. {-490838400 10800 1 IDT}.. {-482976000 7200 0 IST}.. {-459388800 10800 1 I

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kabul

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.8546989169864085
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFKTtNMXGm2OHodFxsYoHvgVHURRNVsRYovFFFkdj/cXHF:SlSWB9eg/2wKTPDm2OHoH+YoHvgVHURA
                                                                                                                                                                                                                                                MD5:9BD9B21661C235C0794078EC98978D3B
                                                                                                                                                                                                                                                SHA1:3D854780F49D0E5F5A190DC9367C7406127C5E4D
                                                                                                                                                                                                                                                SHA-256:A59C95C038F2E945D685D96FA9B859CE82A643A1B7F56EB36B2C809DE91CD4BA
                                                                                                                                                                                                                                                SHA-512:A76E99CF03DA8897F0A210A98DB79E4CD60070F2BE363D0D0960D9882919F9B49978FA55BB2500F1648ADD4080730CAD85BAFF61D885A9EAD394AC04C850F6BA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kabul) {.. {-9223372036854775808 16608 0 LMT}.. {-2524538208 14400 0 +04}.. {-788932800 16200 0 +0430}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kamchatka

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2060
                                                                                                                                                                                                                                                Entropy (8bit):3.788131608921229
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5+SeWI/2kkWk7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5i/2ZsFLrcZwvJt2F+doTr9Q3G80
                                                                                                                                                                                                                                                MD5:390F39934F095F89358B73D056D90264
                                                                                                                                                                                                                                                SHA1:6B57CE5346B50ED88BFBB6BC57F834FB3F564905
                                                                                                                                                                                                                                                SHA-256:6E0278E389072437BC07A5032CD58E9E5B1B2BDB20918632C422EFA97BC43ABF
                                                                                                                                                                                                                                                SHA-512:6C54D94E95D73030F2FFCF8D130494CBD79FB1CEB9B59ADE0743C10F02557C3DD59CC6274B262A7E29C2D4C35DDA4B6A9A0398C661F5BD40F3B92181192B9577
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kamchatka) {.. {-9223372036854775808 38076 0 LMT}.. {-1487759676 39600 0 +11}.. {-1247569200 43200 0 +13}.. {354888000 46800 1 +13}.. {370695600 43200 0 +12}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965600 43200 0 +12}.. {764

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Karachi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):457
                                                                                                                                                                                                                                                Entropy (8bit):4.396286144160272
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862dmdH35Cy6DvjeQXvjKEn6vNEhFc0bkTfb2iWToN1:5de3IjjeQ/jKE6vNNa8
                                                                                                                                                                                                                                                MD5:DF604BCD42A3C1E6BABD0E4FF5764CA3
                                                                                                                                                                                                                                                SHA1:984111F3A75EE7D8760AA2B839010545AF8EE359
                                                                                                                                                                                                                                                SHA-256:4E7F7ACAE8B4018A835328744F680C8054771805BB0BB07678A09737963C090D
                                                                                                                                                                                                                                                SHA-512:690AC3FC7CA3C66AA70F17E38C6B43FFACAB3F86040C3BA94FBFF80AC8C1AECF8192E503282109DABF3228F8DC73C732F1041C80455B8B26BDB25C4C32FA286A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Karachi) {.. {-9223372036854775808 16092 0 LMT}.. {-1988166492 19800 0 +0530}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 +0530}.. {-576135000 18000 0 +05}.. {38775600 18000 0 PKT}.. {1018119600 21600 1 PKST}.. {1033840800 18000 0 PKT}.. {1212260400 21600 1 PKST}.. {1225476000 18000 0 PKT}.. {1239735600 21600 1 PKST}.. {1257012000 18000 0 PKT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kashgar

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):174
                                                                                                                                                                                                                                                Entropy (8bit):4.967143524972358
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8s4YkyXHAIgNrYOARL/2WFKu3e2WFKjov:SlSWB9vsM3yMGSHAIgvAN/2wKulwKjy
                                                                                                                                                                                                                                                MD5:259662F35AA09A891C2DDF8FCFECD6F0
                                                                                                                                                                                                                                                SHA1:DBB3A363A34C33F0B6B0D677E43C2985E2BAF976
                                                                                                                                                                                                                                                SHA-256:7B2251F0A41CBADF45D69F24604834167B14D8D33B510E635719AB404CABBCE2
                                                                                                                                                                                                                                                SHA-512:CD7E514555D58985C774535556B66542EFC5FB7CD5891F42FE21B591612CB7EBD4B41E96593E26E9283BA1B01EF3BE0FDFAE871F5EF6ADF2286AF1E479DCB44B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Urumqi)]} {.. LoadTimeZoneFile Asia/Urumqi..}..set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kathmandu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.896398105471451
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFKXIi7hvXMXGm2OHF+VT5oHsQKwMTXvv6Q6zRk8P4VvW/:SlSWB9eg/2wKYghfDm2OH0T5oHxNMzv8
                                                                                                                                                                                                                                                MD5:7AC6429D2A08372C71C61B4521246FEC
                                                                                                                                                                                                                                                SHA1:6E50F5AD1018398491453D751F8B717B618EF46E
                                                                                                                                                                                                                                                SHA-256:F0A0816E62036637F75081CBF17A1E6B8FBC2D86AEC3CD2E234BBBDD6EC9F109
                                                                                                                                                                                                                                                SHA-512:A5389A318896ABCAFE419262F6B8CA86C917788F1E2AFBC8CB1C074A52870E7A92C9F6F7D79DDE4AB0D267D870D3CCD69B3FC5FD57520352EFE36C583B493FB9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kathmandu) {.. {-9223372036854775808 20476 0 LMT}.. {-1577943676 19800 0 +0530}.. {504901800 20700 0 +0545}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Katmandu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.8363583658476745
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8yIi7V5XHAIgN1AIilvWARL/2WFKSiZ1/2WFKXIi7y:SlSWB9vsM3y7gVJHAIg5QOAN/2wKSg15
                                                                                                                                                                                                                                                MD5:4CCC96293A33113D9ADC4130DCD19CBA
                                                                                                                                                                                                                                                SHA1:7BAB4B8DD6BB415A2FC86D9AB36BE2A893C03153
                                                                                                                                                                                                                                                SHA-256:9ACC9586B6F8B53BFE8B242283A434A9A9633D60559EBFDEE263B4C8915D50CA
                                                                                                                                                                                                                                                SHA-512:644E1777E01C15A728E30526F131462FCE50476A8FEDA9B99F41D95013BB8833A79437E75AA2025E2FD2E253B9AD40709DEF77E1F0C73DAAE7A9CF886A175A03
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kathmandu)]} {.. LoadTimeZoneFile Asia/Kathmandu..}..set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Khandyga

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2119
                                                                                                                                                                                                                                                Entropy (8bit):3.707911838150672
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5No6r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFYkRDhUBAc6l:r5PhtjLiII2JBC6c6l
                                                                                                                                                                                                                                                MD5:D7B394A9662D60D01781005FE73CC9E8
                                                                                                                                                                                                                                                SHA1:50B5EBD02596DC45D1F69358C5B69DD3058905FC
                                                                                                                                                                                                                                                SHA-256:33203D7FB7F3D1F848640ECE0642A2305E1863B4D47413075E2E7E40BD7418E7
                                                                                                                                                                                                                                                SHA-512:055EBA420F2F6049E803796ACCA263264B9E585E5312A86B8DF7B409C5F1CB1810F3AEDACD66CCF4605E55198947D263C240486C2A4D453D23C89802F0C66BBA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Khandyga) {.. {-9223372036854775808 32533 0 LMT}.. {-1579424533 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kolkata

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):336
                                                                                                                                                                                                                                                Entropy (8bit):4.614218930153471
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKvhfDm2OHEX3gYoHrXdUvvYbQLpUFdvjSVVFJLNsR/QFckVVFJLLW:MB8623tmdHNYCDWXYbQtUTvjAJBs50vs
                                                                                                                                                                                                                                                MD5:248F1B5A26455000C936CE8BC02C1A0B
                                                                                                                                                                                                                                                SHA1:0C3F8CD4E038B113E5238AC52652809B6CA27999
                                                                                                                                                                                                                                                SHA-256:6D464564ED2EFC9DADA1586D4FC99FE333726D2BE15A00E30C2391F588896463
                                                                                                                                                                                                                                                SHA-512:AF36B0B3D410305ED504726C87265ACCAF5577A9B5DD7E7DAF135420E356C651287873197431B65B5317B4BA2009274288E4F101AC1274045A8D99E2414AB132
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kolkata) {.. {-9223372036854775808 21208 0 LMT}.. {-3645237208 21200 0 HMT}.. {-3155694800 19270 0 MMT}.. {-2019705670 19800 0 IST}.. {-891581400 23400 1 +0630}.. {-872058600 19800 0 IST}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 IST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Krasnoyarsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2062
                                                                                                                                                                                                                                                Entropy (8bit):3.7086418466382605
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5Ote2CoXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEw:5B40yVRB7VfXucydm46I/CTxwh
                                                                                                                                                                                                                                                MD5:A59F7FFD0C3EBAD47EC5F2B89EBBD9FA
                                                                                                                                                                                                                                                SHA1:ACB94E28E0CF7C6606086267CEA1F63A3E755F56
                                                                                                                                                                                                                                                SHA-256:53B8D5E7FB1BD67FECE66A933D9BDBB773F14A8C04D316A2A1B00EC6DBC151DD
                                                                                                                                                                                                                                                SHA-512:7B3886B9D0A793CCEEDB2B190523922CFEBE5C82A5201C9EFA30CA4C7F63FB75C998CC7E1BD48D5D489F16E36FC0C22BD954CB7D321B3C09B36B60629C4C9F7E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Krasnoyarsk) {.. {-9223372036854775808 22286 0 LMT}.. {-1577513486 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kuala_Lumpur

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.956557779400841
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq801c3vXHAIgNtK1tyHRL/2WFK1NFWFKf1z:SlSWB9vsM3yUgHAIgWv6N/2wK1NFwKf9
                                                                                                                                                                                                                                                MD5:E70767DA85A7E1FA9395FF0B16CFE5CE
                                                                                                                                                                                                                                                SHA1:3F78034F166CFC80B54E56AF289C7700A7E4AA5C
                                                                                                                                                                                                                                                SHA-256:056D352DDCFEC155375430FFF3C8743ED5C9B51B866A099E97E12CC381071F50
                                                                                                                                                                                                                                                SHA-512:FEDC854FB043AA79F132827F98F8983E480727FAA039CF2FB5B82611E724312A4F3F006EE58707F12B0AA90F5872E17F76E2A040CFB3A90D017C5CF92E52DA0A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Singapore)]} {.. LoadTimeZoneFile Asia/Singapore..}..set TZData(:Asia/Kuala_Lumpur) $TZData(:Asia/Singapore)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kuching

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):669
                                                                                                                                                                                                                                                Entropy (8bit):4.074079100812583
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKPLBDm2OHXoH3UTdMVSSFVM5qGeCiKaFzsBRcerUNwGvULhMXeiCs:MB862HL1mdHXC3UBMxJJo9rphTXUzHHF
                                                                                                                                                                                                                                                MD5:489E706324960E86B6E174D913C72E02
                                                                                                                                                                                                                                                SHA1:C7D77482C0D41F3426FC269B3B6C0575EF0E8C7E
                                                                                                                                                                                                                                                SHA-256:6E35E560675B0B5322474900D4EC8326C504788C1F82E533B09785DEEFF092DF
                                                                                                                                                                                                                                                SHA-512:5CEFD44656C041E59A16481E042EA914E7C003BDE6ADF5F49B57052E91F4F732A91A244BD8BC09EF5DC2640D3210DEE53882717C5C4CBD85CCE44A93B028E9C3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuching) {.. {-9223372036854775808 26480 0 LMT}.. {-1383463280 27000 0 +0730}.. {-1167636600 28800 0 +08}.. {-1082448000 30000 1 +08}.. {-1074586800 28800 0 +08}.. {-1050825600 30000 1 +08}.. {-1042964400 28800 0 +08}.. {-1019289600 30000 1 +08}.. {-1011428400 28800 0 +08}.. {-987753600 30000 1 +08}.. {-979892400 28800 0 +08}.. {-956217600 30000 1 +08}.. {-948356400 28800 0 +08}.. {-924595200 30000 1 +08}.. {-916734000 28800 0 +08}.. {-893059200 30000 1 +08}.. {-885198000 28800 0 +08}.. {-879667200 32400 0 +09}.. {-767005200 28800 0 +08}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Kuwait

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):173
                                                                                                                                                                                                                                                Entropy (8bit):4.877362838821003
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFKdQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKdQ6
                                                                                                                                                                                                                                                MD5:EA1DB4B80CC74CBA024B9BF3734B31F2
                                                                                                                                                                                                                                                SHA1:D8131C093BCA3B378BEC606CFEB56A40CB4E246F
                                                                                                                                                                                                                                                SHA-256:8E0C60A9AA64FB8602EDC35311F7436B04853970A21C1F6C871494A09AAD5787
                                                                                                                                                                                                                                                SHA-512:3B57C9CCC16AA4FE71D275D5EC6A7BC1838841023EE4408158362A7E13E7F1B345F7D95006BC8D2FC270158864E286A1A9364C792F679D5803BD82148399C199
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Macao

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):169
                                                                                                                                                                                                                                                Entropy (8bit):4.781739054385376
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8PWXHAIgNz+NOARL/2WFKf+WFKkvn:SlSWB9vsM3yOHAIg1AN/2wKGwKmn
                                                                                                                                                                                                                                                MD5:55DAE27AEAA74FE822338C20B6CDFF68
                                                                                                                                                                                                                                                SHA1:F00EB827DC29EB2063B3A0EDBC39856637C55F33
                                                                                                                                                                                                                                                SHA-256:4308D741C83B263C7C9FB8EC692A7B7B502135E407B265B12EA7EF92523455C0
                                                                                                                                                                                                                                                SHA-512:398EE6015C58BDBBEAB49B74833B938FD84DE1AC6D3B8D095CE772ECA980D9E93F4EBFFFFCEAE7F91E287C8CE4F94B1A078D8E1460C352B7C2018F99915838FF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Macau)]} {.. LoadTimeZoneFile Asia/Macau..}..set TZData(:Asia/Macao) $TZData(:Asia/Macau)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Macau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2217
                                                                                                                                                                                                                                                Entropy (8bit):3.9638741177777868
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5ReCX8Iv3nhPHCvzncCHg9PHjZzH+0HDHN1aHhHNaezHBjHeHsH65H18HDH983lY:5d8u3hfCTcaOrh6qn151Wf3Bogp+nlC
                                                                                                                                                                                                                                                MD5:B184E7403CB7168607D2C9E158F86A3B
                                                                                                                                                                                                                                                SHA1:48B003B8F822BE979FBCB08CBDBFFC617BCF99DB
                                                                                                                                                                                                                                                SHA-256:FBCB92CECB1CB0BC284ADC30D70C5F57B3AFC992136A0D898ABC64490BB700FB
                                                                                                                                                                                                                                                SHA-512:D8C5C67CAEB7C670B7BD1DACC1203C4DEE4DDB16A780F502C4440997CFCFF869E86842EF87C2CD0E0B942941C02A6BC3BDAB7CEAD78B026B68F4A031173400C8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Macau) {.. {-9223372036854775808 27250 0 LMT}.. {-2056692850 28800 0 CST}.. {-884509200 32400 0 +09}.. {-873280800 36000 1 +09}.. {-855918000 32400 0 +09}.. {-841744800 36000 1 +09}.. {-828529200 32400 0 +10}.. {-765363600 28800 0 CT}.. {-747046800 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716461200 32400 1 CDT}.. {-697021200 28800 0 CST}.. {-683715600 32400 1 CDT}.. {-667990800 28800 0 CST}.. {-654771600 32400 1 CDT}.. {-636627600 28800 0 CST}.. {-623322000 32400 1 CDT}.. {-605178000 28800 0 CST}.. {-591872400 32400 1 CDT}.. {-573642000 28800 0 CST}.. {-559818000 32400 1 CDT}.. {-541674000 28800 0 CST}.. {-528368400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-498128400 32400 1 CDT}.. {-478774800 28800 0 CST}.. {-466678800 32400 1 CDT}.. {-446720400 28800 0 CST}.. {-435229200 32400 1 CDT}.. {-415258200 28800 0 CST}.. {-403158600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Magadan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2088
                                                                                                                                                                                                                                                Entropy (8bit):3.7643610103361134
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5he9dbbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKx/y:5wv+0j6lua2Gg/3gO8UoOZU2Wc/pKo
                                                                                                                                                                                                                                                MD5:F62A89F441C9C17EB99F64223C815651
                                                                                                                                                                                                                                                SHA1:408C38A79E056FF9B03D0DA85114DC015CB66938
                                                                                                                                                                                                                                                SHA-256:0C6EEEB7975A95C2B0678D137E6A735238D244A37FA11078050051511DE499FE
                                                                                                                                                                                                                                                SHA-512:55DC72546BDC26450D5318E9D2819E32A91C27D06A7AF5432BD50F8722C69984BBAA8599055A824D2935D919F0C0AA357687DD9B47F49F213EEE21AF7458FE17
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Magadan) {.. {-9223372036854775808 36192 0 LMT}.. {-1441188192 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Makassar

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):243
                                                                                                                                                                                                                                                Entropy (8bit):4.737440985553183
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wK5XDm2OHUVoHxYQTLQTvj1kc3gEpHkH8vScHr0:MB862hTmdHsCLTI6cQe7HHA
                                                                                                                                                                                                                                                MD5:9116C0B70AB33EC49F933EAE0238FD4B
                                                                                                                                                                                                                                                SHA1:BA390E8FBEAF5EA6E861AFC5A51CD4DF0B422461
                                                                                                                                                                                                                                                SHA-256:30D8AB00E32ECE51442C0310E650D89D6989E0809600EE334CB10C506D84BF9D
                                                                                                                                                                                                                                                SHA-512:499E60E8CBDA72226BCB4E241020E62B6F88E7D3E4329D260A6536EF87C02D7D61FD1BECC47D4FF308B4EB5D3E7FFBE2EC1C96FE2DEDC09DD1D973421C5FFE1E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Makassar) {.. {-9223372036854775808 28656 0 LMT}.. {-1577951856 28656 0 MMT}.. {-1172908656 28800 0 +08}.. {-880272000 32400 0 +09}.. {-766054800 28800 0 WITA}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Manila

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):421
                                                                                                                                                                                                                                                Entropy (8bit):4.48495488773916
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862GjmdHnCTZBCvEo6AwoucQzy4orjAbomAtoNv:5GjeCVwvB6AduXzylHAMmAa9
                                                                                                                                                                                                                                                MD5:0FBF0ED252638DF31826C33EB3FFBFE2
                                                                                                                                                                                                                                                SHA1:3496E4A5251A9BDF3AA4368297140780B6DBF66D
                                                                                                                                                                                                                                                SHA-256:070D61A0E39643A700ABA89A8A4BE5733BA456958966098405E11ECDFA854D76
                                                                                                                                                                                                                                                SHA-512:2A40E14964B357809E596DF88D8C4141ED78664BACA0A7724A7CA837EF427DC2B07C48D9DBE5787FAB0015673F5BDE002223D489334C5B91B74EEC5507A14B78
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Manila) {.. {-9223372036854775808 -57360 0 LMT}.. {-3944621040 29040 0 LMT}.. {-2229321840 28800 0 PST}.. {-1046678400 32400 1 PDT}.. {-1038733200 28800 0 PST}.. {-873273600 32400 0 JST}.. {-794221200 28800 0 PST}.. {-496224000 32400 1 PDT}.. {-489315600 28800 0 PST}.. {259344000 32400 1 PDT}.. {275151600 28800 0 PST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Muscat

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):170
                                                                                                                                                                                                                                                Entropy (8bit):4.805992552335358
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8DeXHAIgN6S7ARL/2WFKvE+H+WFKQ3n:SlSWB9vsM3yj+HAIgMS7AN/2wKLewKQ3
                                                                                                                                                                                                                                                MD5:8AEB5C3E81069F884A370714E8013F1F
                                                                                                                                                                                                                                                SHA1:4E3DD4A84627E75E84726C0CBA72CA6801280C2B
                                                                                                                                                                                                                                                SHA-256:011B7DE1C9F7EC241B224BC864D8AE66ACB433FBC8AD939E4DBEB12BE6390243
                                                                                                                                                                                                                                                SHA-512:50B1DE2615AE9B4781505DC709F9D07F6221D4E6D7B61D7BDA682377EAD9807F47FF0E933B79823D0DFD9F3647A82CFC28FB41FBB2226ED1D08B76F86FEB45DC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dubai)]} {.. LoadTimeZoneFile Asia/Dubai..}..set TZData(:Asia/Muscat) $TZData(:Asia/Dubai)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Nicosia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7625
                                                                                                                                                                                                                                                Entropy (8bit):3.7113086720696398
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:R3pv/7V6Aj8aZaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:R3v/AauivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:2ADD0DFC1F133E4D044727234251A3DC
                                                                                                                                                                                                                                                SHA1:0D1502986258349E384017BA6CB8FA0AC424638C
                                                                                                                                                                                                                                                SHA-256:3C3E4844C70D361893EF022D6C3C8E38B243E91D40C5A726C924355476816F25
                                                                                                                                                                                                                                                SHA-512:70CDD53E7E44EDABF653A4F92EECBF5BB20A31DA95D65209D1CADE7DD9FC68946B8EC8829C28AE00BE5F42AAB545B9282CBBCFC5834437D6A94A179BF4FE0141
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Nicosia) {.. {-9223372036854775808 8008 0 LMT}.. {-1518920008 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {62258760

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Novokuznetsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2063
                                                                                                                                                                                                                                                Entropy (8bit):3.718004112421892
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:526enddzXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFf:5l40yVRB7VfXucydm46I/CTxwf
                                                                                                                                                                                                                                                MD5:513B6A2AF76DAED9002C037BEC99862F
                                                                                                                                                                                                                                                SHA1:82D1C47BDF46B8B901C35BACACE8595C093BF5F2
                                                                                                                                                                                                                                                SHA-256:96A445D47D834C28480D1E2036ECA4962B35AFA494C219065D4879F71C1830DB
                                                                                                                                                                                                                                                SHA-512:2FE5AF4FA9D6AAB4FBD8E354789B82D39FA1B52394D3A0ABFBC6A30A531E0B7429A3D9AC7835A2843A6E9859E0255565F151FDFC87004ACB4EBD1AAD40BDA8A4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novokuznetsk) {.. {-9223372036854775808 20928 0 LMT}.. {-1441259328 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Novosibirsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2121
                                                                                                                                                                                                                                                Entropy (8bit):3.714792994893581
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:52sve20ruXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnF:5Hc40yVRB7VfXu0TKmtTTDOWQ
                                                                                                                                                                                                                                                MD5:AC8C8D768503C8334A9FBAEF4C3A9CAB
                                                                                                                                                                                                                                                SHA1:CA10BB99E2D7AB329229759BD4801068A3AEB6D5
                                                                                                                                                                                                                                                SHA-256:EF799077291F6B3B19E0AEC88F224BB592FAAD09D30740F2376D3D20F2169639
                                                                                                                                                                                                                                                SHA-512:34049B1AC4254F999C3E5AD8CB31ABF88AC2D972E20E19927F33CC59935354F92125A0342A413E64227E8AE29DDFC2FFE5F67AE538C89D8EBAD7FCA889321DFA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novosibirsk) {.. {-9223372036854775808 19900 0 LMT}.. {-1579476700 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {738090000 25200 0 +07}.. {7

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Omsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2055
                                                                                                                                                                                                                                                Entropy (8bit):3.6912374223526396
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5abexPvO1FMnFP1FCnFHnFKqenFdDnFQgOnFxjPnFITnFonFJynFAT4TBThSv0FP:5asvjdqxph01NSvPETKmtTTDO0
                                                                                                                                                                                                                                                MD5:3E06B20B0B62AA09FA03082FAEE4FD62
                                                                                                                                                                                                                                                SHA1:8886EC80528ECA13D3364138BFFE92F881768169
                                                                                                                                                                                                                                                SHA-256:2605CD1E26E4AB48BCB4399BB5B17BAD115A47F87BA3DD54B55BB50C3FE82606
                                                                                                                                                                                                                                                SHA-512:04C1B6A898D12C8EA1B0B2F6665C870434061C63CC8F7A067BFC708E9828BA2E60104B82E2025E42D51DA2F485890C4D34EC0341EF466A7942649BE64F5EEE17
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Omsk) {.. {-9223372036854775808 17610 0 LMT}.. {-1582088010 18000 0 +05}.. {-1247547600 21600 0 +07}.. {354909600 25200 1 +07}.. {370717200 21600 0 +06}.. {386445600 25200 1 +07}.. {402253200 21600 0 +06}.. {417981600 25200 1 +07}.. {433789200 21600 0 +06}.. {449604000 25200 1 +07}.. {465336000 21600 0 +06}.. {481060800 25200 1 +07}.. {496785600 21600 0 +06}.. {512510400 25200 1 +07}.. {528235200 21600 0 +06}.. {543960000 25200 1 +07}.. {559684800 21600 0 +06}.. {575409600 25200 1 +07}.. {591134400 21600 0 +06}.. {606859200 25200 1 +07}.. {622584000 21600 0 +06}.. {638308800 25200 1 +07}.. {654638400 21600 0 +06}.. {670363200 18000 0 +06}.. {670366800 21600 1 +06}.. {686091600 18000 0 +05}.. {695768400 21600 0 +07}.. {701812800 25200 1 +07}.. {717537600 21600 0 +06}.. {733262400 25200 1 +07}.. {748987200 21600 0 +06}.. {76471200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Oral

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1664
                                                                                                                                                                                                                                                Entropy (8bit):3.708603813141953
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:53PvalvNhQQvmRKqv0fvzQIovWdvEGvDaDv7w9hYwr:JHaBNKs6b03zB0WJEuDa77w9hYA
                                                                                                                                                                                                                                                MD5:A3BD0C15642AE4F001F98F8E060E8374
                                                                                                                                                                                                                                                SHA1:366F3C7FD4000AC23B79AB0FF4429371ED323B81
                                                                                                                                                                                                                                                SHA-256:933BBCD7AE0BF59A5B4A6E0EF74C237FEEDC42E6A3AEB2158131AA70FBA6FE47
                                                                                                                                                                                                                                                SHA-512:16D8692D3EA96D3594E6220A6989BBFBB926A66EEBEB240C4DC68BE75C69C5206659D9D341D92AE6128928FD38A5F45B445621CBBBA4E4BA8C34C3AC52BF3C08
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Oral) {.. {-9223372036854775808 12324 0 LMT}.. {-1441164324 10800 0 +03}.. {-1247540400 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {701816400 14400 0 +04}.. {701820000 18000 1 +04}.. {717544800 14400 0 +04}.. {733269600 18000 1 +04}.. {74899440

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Phnom_Penh

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.958543249401788
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKeHKLNM0WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKTNg
                                                                                                                                                                                                                                                MD5:EBF01E229CC41EB8B27650A3D668EDC1
                                                                                                                                                                                                                                                SHA1:33E1B252C1B45EAE326FCF8CC7C80C78A46F7E8D
                                                                                                                                                                                                                                                SHA-256:DCEE88876D00396918F43DECA421B6C9B02F84B5866A2CE16E641B814B390A9F
                                                                                                                                                                                                                                                SHA-512:80840600F37A256B8FD9933760FBAE7C13DE1E24EFD970E47BE8DEC731DFABF6D6FB76999BEEC775FF8C8B8719E94788ED7EEB04376A34C827ACB443F720F7E3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Pontianak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):369
                                                                                                                                                                                                                                                Entropy (8bit):4.492596995768464
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKT5PDm2OHUeoH99xV/1kc5k/MVSSFFCLkvScH+dMVSSFL1CnF4mMz:MB862L5bmdHFCRV/6c5kMxGLkHHaMxFn
                                                                                                                                                                                                                                                MD5:9ADB1A9E41A143A06116E24EA0A53D90
                                                                                                                                                                                                                                                SHA1:6E50B549E1A705C0090BD5EDE26F7DED78CDF71A
                                                                                                                                                                                                                                                SHA-256:AC8370AEDF5FE3FE1E80710CE117DEE23815BE377D418E4B4F3259A1930E8DBF
                                                                                                                                                                                                                                                SHA-512:92790B20B960AC518AB2E18F902C6E0BA887F268909F5571CAC1068F5E719CCF6943AE6902DA1B683E170658B5E7BE06C6A187C1C0A652DD052D5BD0B2A7B84D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pontianak) {.. {-9223372036854775808 26240 0 LMT}.. {-1946186240 26240 0 PMT}.. {-1172906240 27000 0 +0730}.. {-881220600 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 28800 0 WITA}.. {567964800 25200 0 WIB}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Pyongyang

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):273
                                                                                                                                                                                                                                                Entropy (8bit):4.709411633376997
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wK8cE4SDm2OHnNoH9Aw8vmVuT0vjLtcjviov:MB8620cExmdHnNCGv2Ezv
                                                                                                                                                                                                                                                MD5:727BBC1A1662B500F616F544A484F213
                                                                                                                                                                                                                                                SHA1:93C1D902D9D4AA4197C7D16C61FB784AC01D0DE5
                                                                                                                                                                                                                                                SHA-256:29BA17F756F5C0BBA30FEBF44E620504D04921C832BD1CB56E1B60EF288B57DF
                                                                                                                                                                                                                                                SHA-512:C3C91E2F180109FF33E6491722F679A1B8DCE8CD31DE006D7FF2CBE270C008E927507C953641D28EE77D139BBEA54DEA1B7DBD6C30B208DDAB1B58756C32AC02
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pyongyang) {.. {-9223372036854775808 30180 0 LMT}.. {-1948782180 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-768646800 32400 0 KST}.. {1439564400 30600 0 KST}.. {1525446000 32400 0 KST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Qatar

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.851251407399968
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFKK3ovXMXGm2OHPFV4YoHsQKb3VvVsRYovFFF3FRVGsWr:SlSWB9eg/2wKK3yXDm2OHoYoHxcvSNFS
                                                                                                                                                                                                                                                MD5:CBA9635133F88AD3B27E23B95430C27C
                                                                                                                                                                                                                                                SHA1:5E41232EC03BBC71B522F58CB2D05E6BFFFF1A75
                                                                                                                                                                                                                                                SHA-256:18CCA69F933795CE3F7DB31506EFC063E6CE1DFDCAB32AA387C398456D7F7E1F
                                                                                                                                                                                                                                                SHA-512:D7C43F1F9ADA54C914ADB3CB2C9063EB7044089CFC7755ACFD08828CDEBA3C116AE2BE916ABE5D561E63699B921BC52636DD0BBC2C4304F813616D320D7DDAAF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qatar) {.. {-9223372036854775808 12368 0 LMT}.. {-1577935568 14400 0 +04}.. {76190400 10800 0 +03}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Qostanay

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1668
                                                                                                                                                                                                                                                Entropy (8bit):3.7299735983334195
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5DwvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQA:BMaBNKs6b03zB0WJEuDa7sFZiKWaN6TE
                                                                                                                                                                                                                                                MD5:F5DBE4E72FA5AB0019CC98C8E21EC86E
                                                                                                                                                                                                                                                SHA1:27ECB901AA07C18EA7F38235E8EFE0B1635FEFBC
                                                                                                                                                                                                                                                SHA-256:4191629B874C988291E8FD13E675A3ED685D677F6541313975FC4610E47F1DCD
                                                                                                                                                                                                                                                SHA-512:D5EFD4EFFFFE2E41909AEB7B67BD1FA6FAF4B8E9AC645518D5B33BD1B3C5084F59D47D4ED052E0D4B9F9989BDDBA3AECB3D1E67F5237914D24C01F9C95242396
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qostanay) {.. {-9223372036854775808 15268 0 LMT}.. {-1441167268 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {7489

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Qyzylorda

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1670
                                                                                                                                                                                                                                                Entropy (8bit):3.734572151642808
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5NvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWgvNSvTqvIQvyovklvqQX0:TaBNKs6b03zB0WJEuDa7sFZiKWcN6Tir
                                                                                                                                                                                                                                                MD5:026EC6E479EC006C4398288362254680
                                                                                                                                                                                                                                                SHA1:24AD03DD21DA394B3423D27211955BFD694F8E73
                                                                                                                                                                                                                                                SHA-256:CD6B067AA3EF6935B4E89CA36E6A03FCB97F1E0EE61A7B5D46C06BF4DE140774
                                                                                                                                                                                                                                                SHA-512:023AC55E118F13A31CE996C7BA155C90D47DEB6C223EEB3C0EE7B702871FF0CCA13CDF61D65FDDABE41B888CD7A74274AA5730059CC5688F8ED4DDBF8FE4ECA4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qyzylorda) {.. {-9223372036854775808 15712 0 LMT}.. {-1441167712 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {701812800 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Rangoon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):174
                                                                                                                                                                                                                                                Entropy (8bit):4.812955128020714
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8nv3vXHAIgNnDA6RL/2WFK02KQMFfh4WFKsyn:SlSWB9vsM3yHvPHAIg15N/2wK0GEJ4wy
                                                                                                                                                                                                                                                MD5:BD3F294F1EDDD21467E980C9F5A0E7DE
                                                                                                                                                                                                                                                SHA1:11A3FC3E4489C18BDF9BFFB4C44615559D9DD99D
                                                                                                                                                                                                                                                SHA-256:E4D2C38D8E7377A528291A88129CDAC40CA4D40A5F1CD8ADB98228527556906E
                                                                                                                                                                                                                                                SHA-512:FA5FD600627793EABB83C1066BE246A47BCCE1FC57830596B9C0CDE8901B949AF178ABDE876C3B73CC3751312E8A4C03C390888B0B5A9669F511344143F83073
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Yangon)]} {.. LoadTimeZoneFile Asia/Yangon..}..set TZData(:Asia/Rangoon) $TZData(:Asia/Yangon)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Riyadh

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):148
                                                                                                                                                                                                                                                Entropy (8bit):4.973311159904374
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFK814PMXGm2OHFukeoHqUi9VssWYcv:SlSWB9eg/2wK81GDm2OHF7eoHvi9V1Wr
                                                                                                                                                                                                                                                MD5:AD3236CFF141732831732357AB181EE3
                                                                                                                                                                                                                                                SHA1:EAF51A63898A2048EA5FBE9BA4C001EEE37FFDB2
                                                                                                                                                                                                                                                SHA-256:411E31D09FFA48E44169C42661AE2F7FC142460BCAA216837D8C4740983CA7BD
                                                                                                                                                                                                                                                SHA-512:6CA2D89C02568580786BE98A863453ADCF4D21CAC52E5B44C4F7A05E76D29AEB3E28E353D6FB758BB553DBC8F35389462B388F61E94C68F5DB50A3E8C429336D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Riyadh) {.. {-9223372036854775808 11212 0 LMT}.. {-719636812 10800 0 +03}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Saigon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.946090704619887
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8I65eV5XHAIgN2h6560ARL/2WFKwJ6h4WFK365ey:SlSWB9vsM3yJAVJHAIgA4k0AN/2wKl4i
                                                                                                                                                                                                                                                MD5:0766480A295525EE5D65F1ED32094858
                                                                                                                                                                                                                                                SHA1:7A2D68E1009DDD809A4A700931456C617DCD343A
                                                                                                                                                                                                                                                SHA-256:C695981A0DF691C3F4509999FBC52858ADC75024CCCBDEFBE1094FED17E809E4
                                                                                                                                                                                                                                                SHA-512:A21536FB61A64E953E8D6414FF0AEF1BC7E68A33C5DCF7090517A91FC449B96A93A4FBDF2C00682540D1193FDB29603349F5BDB455FD90045FDBCA61247A9860
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ho_Chi_Minh)]} {.. LoadTimeZoneFile Asia/Ho_Chi_Minh..}..set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Sakhalin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2117
                                                                                                                                                                                                                                                Entropy (8bit):3.7276904131666577
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5q+3Vv+0j6lua2Gg/3gO8UoflcXRDhUBAc+:YxIa2GOT8tiXBC6c+
                                                                                                                                                                                                                                                MD5:295D51B8FBBE890C97637687B8F32322
                                                                                                                                                                                                                                                SHA1:7BB72B0EC783898DDF625D275E3BBB964D1693FB
                                                                                                                                                                                                                                                SHA-256:D7D0EA5CEF908442AB0D777A4B097BED18540CD5280FF63F33DD989E27E72908
                                                                                                                                                                                                                                                SHA-512:9B3E3BA01EAE38A00B0EE8A8FB17191CB4ED2EE9E46AE06403BA8C1193804764C86599840DC03E0C6A631456E1BE2BC560BDF6CF0450068EF78A6E494041326C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Sakhalin) {.. {-9223372036854775808 34248 0 LMT}.. {-2031039048 32400 0 +09}.. {-768560400 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Samarkand

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):879
                                                                                                                                                                                                                                                Entropy (8bit):3.9460497720710506
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5t8eZd7QvalvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKT10Sv6r:5MvalvNhQQvmRKqv0fvzQIovWdvEGvDO
                                                                                                                                                                                                                                                MD5:10A758996B0DF756E520541BEA9B7D75
                                                                                                                                                                                                                                                SHA1:137E5FD4E00CFA4B3939EF11868862B7F93D87CD
                                                                                                                                                                                                                                                SHA-256:35E4B905723891281D9A6A0A1FD3760A3A48136E1419C686BE31ACE83BF7AA9D
                                                                                                                                                                                                                                                SHA-512:7E32661731EAB2ED8C387533ACCB4853F5B6225BAC11E93247E7B06D7AA856E6A665F63718BFE395CFD00F80A4C16789D7097FFA8DAD88B1D707BF9C155C1D4C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Samarkand) {.. {-9223372036854775808 16073 0 LMT}.. {-1441168073 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Seoul

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):985
                                                                                                                                                                                                                                                Entropy (8bit):4.121802167517286
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5AemgvHzF+zg2c+z3NGmJhIUfqII8yHg/zoD:5F/nfWUBISHg/G
                                                                                                                                                                                                                                                MD5:A1DE6975DEA70D7241B5B3C43E1EA3AA
                                                                                                                                                                                                                                                SHA1:35EE563A2BCA77C761F7E878997763EA8D258040
                                                                                                                                                                                                                                                SHA-256:C4F82C94650572FE4D03BC1FE54CED8F4BF55DFBEE855D52DE3EA6378240AF93
                                                                                                                                                                                                                                                SHA-512:1639B0609115DBEA6A381986A732A5CA1523952AEF84843B4D714D5B2FF40B16C4166D8D60D31D4FC2C2BA34DED1F6DB39474336195603562265BDBF71687696
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Seoul) {.. {-9223372036854775808 30472 0 LMT}.. {-1948782472 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-767350800 32400 0 KST}.. {-681210000 36000 1 KDT}.. {-672228000 32400 0 KST}.. {-654771600 36000 1 KDT}.. {-640864800 32400 0 KST}.. {-623408400 36000 1 KDT}.. {-609415200 32400 0 KST}.. {-588848400 36000 1 KDT}.. {-577965600 32400 0 KST}.. {-498128400 30600 0 KST}.. {-462702600 34200 1 KDT}.. {-451733400 30600 0 KST}.. {-429784200 34200 1 KDT}.. {-418296600 30600 0 KST}.. {-399544200 34200 1 KDT}.. {-387451800 30600 0 KST}.. {-368094600 34200 1 KDT}.. {-356002200 30600 0 KST}.. {-336645000 34200 1 KDT}.. {-324552600 30600 0 KST}.. {-305195400 34200 1 KDT}.. {-293103000 30600 0 KST}.. {-264933000 32400 0 KST}.. {547578000 36000 1 KDT}.. {560883600 32400 0 KST}.. {579027600 36000 1 KDT}.. {592333200 32400 0 KST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Shanghai

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):981
                                                                                                                                                                                                                                                Entropy (8bit):4.16042656890735
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5Te3vvZJzHjwH6kHp7FH32AzHjZBHNHlQHuHxmHUjH6zHj2HBHeC:5ovZZO7lLpT24
                                                                                                                                                                                                                                                MD5:A266AA43A84FD5E4890BC77AA4E240D0
                                                                                                                                                                                                                                                SHA1:CD88C5D451CD7D3F50C9B36FDD47C84D20377441
                                                                                                                                                                                                                                                SHA-256:3AABB42D9EFE95D906B7F34640E7815919A1A20979EBB6EC1527FCAA3B09B22A
                                                                                                                                                                                                                                                SHA-512:13AE48F58C9AF24002F0FE4F28BF96B10EE0ED293E0DE9D29BCEBAAE102B2EA818F42CA4069544A254C95444A48604EC57E6AB2BEBDA4B5E72C82B49E61AD0A0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Shanghai) {.. {-9223372036854775808 29143 0 LMT}.. {-2177481943 28800 0 CST}.. {-1600675200 32400 1 CDT}.. {-1585904400 28800 0 CST}.. {-933667200 32400 1 CDT}.. {-922093200 28800 0 CST}.. {-908870400 32400 1 CDT}.. {-888829200 28800 0 CST}.. {-881049600 32400 1 CDT}.. {-767869200 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-650016000 28800 0 CST}.. {515527200 32400 1 CDT}.. {527014800 28800 0 CST}.. {545162400 32400 1 CDT}.. {558464400 28800 0 CST}.. {577216800 32400 1 CDT}.. {589914000 28800 0 CST}.. {608666400 32400 1 CDT}.. {621968400 28800 0 CST}.. {640116000 32400 1 CDT}.. {653418000 28800 0 CST}.. {671565600 32400 1 CDT}.. {684867600 28800 0 CST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Singapore

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):372
                                                                                                                                                                                                                                                Entropy (8bit):4.436676898144829
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKfbSDm2OHxdoHvm5vWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScHS:MB862nbGmdHDCvsvDTMsF/CFDMx/HHbe
                                                                                                                                                                                                                                                MD5:C3D13D921E4C6E475910E5080B761C32
                                                                                                                                                                                                                                                SHA1:8C5AE73C4098D03908E5D567FD7C4D827601D718
                                                                                                                                                                                                                                                SHA-256:05C76B58A4E356FD358E24FBC71FAE98DCB18C441C8D8CBB13A18D4F6E406062
                                                                                                                                                                                                                                                SHA-512:3A620597469D31577ECAAA098C95C244F0C288ABACE9E8964D8641154C1893967EFBD7211A41751D0D4CC1B0B9A2286F11738EFB7D01F110A4826BBE1844A2EA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Singapore) {.. {-9223372036854775808 24925 0 LMT}.. {-2177477725 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Srednekolymsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2064
                                                                                                                                                                                                                                                Entropy (8bit):3.7913177223006698
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5HJeidmbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxwy:5HSv+0j6lua2Gg/3gO8UoOZU2Wc/pKf
                                                                                                                                                                                                                                                MD5:B4FA38E884A85F6BD47C8BB02BB0500C
                                                                                                                                                                                                                                                SHA1:1DD135B79CC0D81C048D7B2C6BE0CF71171DD19E
                                                                                                                                                                                                                                                SHA-256:705D6D8360C2DCD51E909E39E1910FE876145220D151031612DA36B247207395
                                                                                                                                                                                                                                                SHA-512:2D32AAAF1BCC865B5F2810BFE0FB82BE98140BB5F2ECA1DA7FD148A3074DA127B81242F17B8BA9C9E259B61CBB123FD1513CCE6A85C8D7679ADFC0D689B552BB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Srednekolymsk) {.. {-9223372036854775808 36892 0 LMT}.. {-1441188892 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Taipei

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1344
                                                                                                                                                                                                                                                Entropy (8bit):4.062084847879695
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5X2eIvZPzGzHjZBHNHlQHKn3HnHNd9HiHkHBHaHLHMtyH9Qm+zHFOzHZ32HZvHiR:5Xi1ypBvt1mwO3Kq46T
                                                                                                                                                                                                                                                MD5:AECA800C8F2A679D0B19E5BB90AFD858
                                                                                                                                                                                                                                                SHA1:2C7DCEB709F9A4312C511971FE1E6A9DC1FBD0E8
                                                                                                                                                                                                                                                SHA-256:389C9D3EE2970665D0D8C5CB61B8B790C5FBDDC0DF0BF2B9753046F5953A477F
                                                                                                                                                                                                                                                SHA-512:C2D6BB4FEB5848D0704647D26F94C0BD8CD7E834AA2187EC9C877E80157E9CC225BBA3BECEE0148894C8639105D292AB50EE95830992BF357C632ACF001E020F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Taipei) {.. {-9223372036854775808 29160 0 LMT}.. {-2335248360 28800 0 CST}.. {-1017820800 32400 0 JST}.. {-766224000 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-639133200 28800 0 CST}.. {-620812800 32400 1 CDT}.. {-607597200 28800 0 CST}.. {-589276800 32400 1 CDT}.. {-576061200 28800 0 CST}.. {-562924800 32400 1 CDT}.. {-541760400 28800 0 CST}.. {-528710400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-497174400 32400 1 CDT}.. {-478688400 28800 0 CST}.. {-465638400 32400 1 CDT}.. {-449830800 28800 0 CST}.. {-434016000 32400 1 CDT}.. {-418208400 28800 0 CST}.. {-402480000 32400 1 CDT}.. {-386672400 28800 0 CST}.. {-370944000 32400 1 CDT}.. {-355136400 28800 0 CST}.. {-3394080

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Tashkent

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):878
                                                                                                                                                                                                                                                Entropy (8bit):3.9280321712564845
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5geQqdNRvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10Sv6r:5+EvdJqxiF0rvK50Sv6r
                                                                                                                                                                                                                                                MD5:DB59DB8E401E12917B7367D5604D3DE6
                                                                                                                                                                                                                                                SHA1:7CC7C5C1DB551BD381B833C81746201D36BC59A9
                                                                                                                                                                                                                                                SHA-256:4445F3F892C7267A6867009CC1A3F0B0548D0240408375A9D15360B28993C2A9
                                                                                                                                                                                                                                                SHA-512:2C7AE63C408A9F06F973AAC16845E1DBE92D15A421BBBE420914F21155AD5E57CD058D7E4427E43185E023D2FF475EBF9D74003ECEF004FF4E5F9D5681ADFB80
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tashkent) {.. {-9223372036854775808 16631 0 LMT}.. {-1441168631 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Tbilisi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1729
                                                                                                                                                                                                                                                Entropy (8bit):3.6815162494646034
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5yBeqvIdZlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPqUsx9Ul4N:5MmsUf8mFpNWFnytO6VnYK
                                                                                                                                                                                                                                                MD5:C376C9ED66F6CC011E063D3E8E0DCED1
                                                                                                                                                                                                                                                SHA1:13C6345F8CB0EC79FE7C78B156C5737BCB66E49E
                                                                                                                                                                                                                                                SHA-256:B637BB0E49144C717E99E93540CB2C4D3695D63B91FE42547F2F0AA006498693
                                                                                                                                                                                                                                                SHA-512:FD60192CBEDC91C5D6B3B5E6F19DEDCAE14DCF48DCAE6D4865A8F0BBDC01CBF8DAAE92C4C46C353AF5B3EEE36CCC87B23F193DDF221132F5404C42507B708364
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tbilisi) {.. {-9223372036854775808 10751 0 LMT}.. {-2840151551 10751 0 TBMT}.. {-1441162751 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {694213200 10800 0 +03}.. {701816400 14400 1 +03}.. {717537600 10800 0 +03}.. {733266000 14400 1 +03}.. {748

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Tehran

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2354
                                                                                                                                                                                                                                                Entropy (8bit):3.666553647637418
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5Z2eendFalxbr1p4USUcESUUxSuEqzSUUongA3jJW3eY37U8uuZrc3cNWH1/ANzx:54G9SOSWzx1qcK83kv3OR0xV1ox
                                                                                                                                                                                                                                                MD5:A7A174A14E51E0ACD7092D2A5AA50F99
                                                                                                                                                                                                                                                SHA1:69ADDDDB68084B90819AD49A5230D5B0E1A9CD85
                                                                                                                                                                                                                                                SHA-256:25870503A8A679DA13B98117BD473EAA0C79B094B85D3AD50629FF0946D5EACE
                                                                                                                                                                                                                                                SHA-512:1ECFB558B13C94BDC848E7BBBB0CA1BB854BB12E112EBF306045EC14F00CE3E3C2DA51EBA8AF2D63C95D71B945647C3D9E9881158FE128DEBE940A742C4BFEB1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tehran) {.. {-9223372036854775808 12344 0 LMT}.. {-1704165944 12344 0 TMT}.. {-1090466744 12600 0 +0330}.. {227820600 16200 1 +0330}.. {246227400 14400 0 +04}.. {259617600 18000 1 +04}.. {271108800 14400 0 +04}.. {283982400 12600 0 +0330}.. {296598600 16200 1 +0330}.. {306531000 12600 0 +0330}.. {322432200 16200 1 +0330}.. {338499000 12600 0 +0330}.. {673216200 16200 1 +0330}.. {685481400 12600 0 +0330}.. {701209800 16200 1 +0330}.. {717103800 12600 0 +0330}.. {732745800 16200 1 +0330}.. {748639800 12600 0 +0330}.. {764281800 16200 1 +0330}.. {780175800 12600 0 +0330}.. {795817800 16200 1 +0330}.. {811711800 12600 0 +0330}.. {827353800 16200 1 +0330}.. {843247800 12600 0 +0330}.. {858976200 16200 1 +0330}.. {874870200 12600 0 +0330}.. {890512200 16200 1 +0330}.. {906406200 12600 0 +0330}.. {922048200 16200 1 +0330}.. {937942200 12600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Tel_Aviv

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.876713308636272
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/2WFK+TT52WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/2wKsswKR
                                                                                                                                                                                                                                                MD5:40B15013485EE2138A3DCB915F9121E7
                                                                                                                                                                                                                                                SHA1:3ADBE38686C7CA1FDE3DDD12BE908F39BFD1E228
                                                                                                                                                                                                                                                SHA-256:07537A30E6236D9E334DAFD5C4D352D25FDEF95D6DC7496F5D93EFAB74D9EBB1
                                                                                                                                                                                                                                                SHA-512:DA3B7B44B3BEF07CA8AA5253BF684A838181D8A15D7CCF0447A6B5F5BAE28D155CF65BCFB6286EB36C0B9F4FDD1FE862A3297ADB6FC33532B9F766334283D725
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Thimbu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.906503135441824
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8kNZ4WXHAIgNqFNKARL/2WFK9Z752WFKvNZovn:SlSWB9vsM3ykZ42HAIgc3KAN/2wKf126
                                                                                                                                                                                                                                                MD5:081862B6FB33389BEC9B0E6B500AA342
                                                                                                                                                                                                                                                SHA1:AF9467BB87C4C28921DF62A87B81223052F9FF4A
                                                                                                                                                                                                                                                SHA-256:37459C17B59639DF62B3F3943751902CE6AAF1F11B7630069DB45052EBEFB5B9
                                                                                                                                                                                                                                                SHA-512:CAF6F1C928528C4471229A2EF2944623545626532986628E6CE38884535286A0B38BA88C1A295E8B11322475D6BFAC61BF89786A76330C1A0C729339A3532BAF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Thimphu)]} {.. LoadTimeZoneFile Asia/Thimphu..}..set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Thimphu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.887493603495978
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFKvNZJMXGm2OHEQUTFnoHqVaJKuc/v6Q61V9gmZVFSTVV:SlSWB9eg/2wKVZJDm2OHEfnoHDKuc/SC
                                                                                                                                                                                                                                                MD5:F239452984CCA9F23E97A880652C39E6
                                                                                                                                                                                                                                                SHA1:52D25282D03B79960F152D21E7492EE26DAEBBAA
                                                                                                                                                                                                                                                SHA-256:B797C74E3840298C3CD8149FC8AA4BCE839EFE79E7C3310986FF23C965607929
                                                                                                                                                                                                                                                SHA-512:1044BEDAE04FCA7BD62937AFCE70F6C447583A90DD1596C3029A64A8251E3F73C106F4D940548DD38E895D67FEFDCD196B257E11437DEB399085EE80C345AA50
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Thimphu) {.. {-9223372036854775808 21516 0 LMT}.. {-706341516 19800 0 +0530}.. {560025000 21600 0 +06}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Tokyo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):388
                                                                                                                                                                                                                                                Entropy (8bit):4.470556147950505
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862ymdHOx5CvAoK3zoiIxtoFDIe+zT0agbov:5yeOCvARzzCOVa/gby
                                                                                                                                                                                                                                                MD5:3CCC15B63A882DB1B7459A51CD1C8165
                                                                                                                                                                                                                                                SHA1:77A3EFE6E4EE524B9EC6F51593DD7521FD7B8DAD
                                                                                                                                                                                                                                                SHA-256:3DA522FA88541A375D53F30A0B62DC4A305FA0315FEE534B7998C9E0A239450A
                                                                                                                                                                                                                                                SHA-512:15238E96DABAB5D2B9FFD25B3F50417ED32205FA69239D6F6B28DA97A378D669FD409164964D0DD2A5B1D795C8F60E8D4EB15924046348C3D6010646A536E07C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tokyo) {.. {-9223372036854775808 33539 0 LMT}.. {-2587712400 32400 0 JST}.. {-683802000 36000 1 JDT}.. {-672310800 32400 0 JST}.. {-654771600 36000 1 JDT}.. {-640861200 32400 0 JST}.. {-620298000 36000 1 JDT}.. {-609411600 32400 0 JST}.. {-588848400 36000 1 JDT}.. {-577962000 32400 0 JST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Tomsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2116
                                                                                                                                                                                                                                                Entropy (8bit):3.695316005718174
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5CeLz/XJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEno:5H040yVRB7VfXucydm4IqtTTDOS
                                                                                                                                                                                                                                                MD5:E95DE93CBCE72C5E02D7ECFE94C96308
                                                                                                                                                                                                                                                SHA1:59A49EBFE544D97545BADFEFE716BB5659C64C20
                                                                                                                                                                                                                                                SHA-256:6B64A01D0F0B5EC7A1410C3BD6883BA7CC133E9F073D40E8BFECE037E3A3FA24
                                                                                                                                                                                                                                                SHA-512:9E33DC9C1C6D60F3226263C484AF46A14AAB31F838516A0D69BA08F8F416EF10D09697E8D7ABAC1CE1F5BCE8AB0C2635D99FBE70C89ECC268DED0DCE89E67466
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tomsk) {.. {-9223372036854775808 20391 0 LMT}.. {-1578807591 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7647084

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Ujung_Pandang

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.897140749162557
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8pYFfXHAIgNzGRRL/2WFKPQOrFJ4WFKov:SlSWB9vsM3yWFPHAIg0RN/2wKPQOrFJD
                                                                                                                                                                                                                                                MD5:F6AE33D706C36FDD8A21F44AD59F5607
                                                                                                                                                                                                                                                SHA1:94D6EC7A437249AEBE2FA4AF8AFB029A620368C0
                                                                                                                                                                                                                                                SHA-256:732751845ACEDBFFD3C6170F4B94CB20B25BFDCFCC5EEA19F4BE439F5C5B573A
                                                                                                                                                                                                                                                SHA-512:2314AB2B154887842211C9A570BC1323D9B4375FF60C96296835DB001E8A277CA62D40B8562BC34EDDF281D96D5325640B79F7907558C6E0319C7D2A76BE239C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Makassar)]} {.. LoadTimeZoneFile Asia/Makassar..}..set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Ulaanbaatar

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1590
                                                                                                                                                                                                                                                Entropy (8bit):3.7728141273024374
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5IerIvusF7cCGK6zoCjZte3kzMjsBw0oZzlL98oysHqGzJvqE+ksabzdX+YjL:5VujmUCei46oljFC67
                                                                                                                                                                                                                                                MD5:A4647294401D2B54ABAA8E509BF05A6F
                                                                                                                                                                                                                                                SHA1:BF804CC38996D7715E3BA9BAD715D7ADBED781B9
                                                                                                                                                                                                                                                SHA-256:A56A26981163A717CF388A423CFE7A2BAD1BE8652BE2E338670CBC0C0A70E5E9
                                                                                                                                                                                                                                                SHA-512:B43157FABDE016FA6636CAB7B06CC1DEA53526B42FB46BB41DC4B7E48188D191C325BEF0D170B125E885F321C4316746A8D478D798828E2DC4A51C71DA4A610C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ulaanbaatar) {.. {-9223372036854775808 25652 0 LMT}.. {-2032931252 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 32400 1 +08}.. {433782000 28800 0 +08}.. {449596800 32400 1 +08}.. {465318000 28800 0 +08}.. {481046400 32400 1 +08}.. {496767600 28800 0 +08}.. {512496000 32400 1 +08}.. {528217200 28800 0 +08}.. {543945600 32400 1 +08}.. {559666800 28800 0 +08}.. {575395200 32400 1 +08}.. {591116400 28800 0 +08}.. {606844800 32400 1 +08}.. {622566000 28800 0 +08}.. {638294400 32400 1 +08}.. {654620400 28800 0 +08}.. {670348800 32400 1 +08}.. {686070000 28800 0 +08}.. {701798400 32400 1 +08}.. {717519600 28800 0 +08}.. {733248000 32400 1 +08}.. {748969200 28800 0 +08}.. {764697600 32400 1 +08}.. {780418800 28800 0 +08}.. {796147200 32400 1 +08}.. {811868400 28800 0 +08}.. {828201600 32400 1 +08}.. {843922800 28800 0 +08}.. {859

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Ulan_Bator

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                                Entropy (8bit):4.728285544456033
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8TcXkXHAIgNrfcXORL/2WFKhrMEBQWFKucXB:SlSWB9vsM3yXHAIgTN/2wKhrMEewKX
                                                                                                                                                                                                                                                MD5:D2EAEA6182FB332CAA707B523F6C8A9D
                                                                                                                                                                                                                                                SHA1:3BFC654E2B3BCF902AF41AEEC46772C84FFF3890
                                                                                                                                                                                                                                                SHA-256:D17FDAF17B3DAC3A1310E2332F61585598185E64CED799ABD68249EB5B698591
                                                                                                                                                                                                                                                SHA-512:E16BEE28BFE3AFFFE6F0025C09D0D65001F38D5045AAB1B554E4D3A66A88273F985B7BAA11F8D26E76E5ABC9F559E3E4B794CC939AAD5FF012A5A47924D08CB3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ulaanbaatar)]} {.. LoadTimeZoneFile Asia/Ulaanbaatar..}..set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Urumqi

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):149
                                                                                                                                                                                                                                                Entropy (8bit):5.006390440264841
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2WFKjhfMXGm2OHEVPoHsWA0GVFSTVVn:SlSWB9eg/2wKjJDm2OHEVPoH3A0CUX
                                                                                                                                                                                                                                                MD5:D6245CAAEC9BA2579F4CEFFF196A9369
                                                                                                                                                                                                                                                SHA1:4D182953F2CEEFF3583265F977B14F40C1A2FB43
                                                                                                                                                                                                                                                SHA-256:C445B8030DEDDDED0AFF5CC692CC323B63BE8C14BBD42DC3FDE90AD4F9D14785
                                                                                                                                                                                                                                                SHA-512:A32C477B6FAA79247907D1C4E2DF400B05AF4B529277C4CE12B33097872311E3F579115DC8CBA93DAC936928FD574414F3473A9CB7C8E85AB57CCA57489B60F8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Urumqi) {.. {-9223372036854775808 21020 0 LMT}.. {-1325483420 21600 0 +06}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Ust-Nera

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2058
                                                                                                                                                                                                                                                Entropy (8bit):3.773734429231407
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5petrlfgLv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxKG:5Ysv+0j6lua2Gg/3gO8UoOZU2Wc/pKF
                                                                                                                                                                                                                                                MD5:5ADD78E4AFCBA913D078A8790861A2DE
                                                                                                                                                                                                                                                SHA1:BB63A762D5D76C0FD3CB9AB2BCDE95718E1C99EB
                                                                                                                                                                                                                                                SHA-256:9D639C0FC69B3BEEBC96969092F9590EB48E7946E901B225BF245E165973B9A8
                                                                                                                                                                                                                                                SHA-512:7C2418FD1F96F101B83E2ABDF2551405C6E429DBBF30A2FA7CD2477E2CE1CEEBB790C51B28AEFF043BA7A7A914CEF3C812668058D69225B9FE9475C56508453D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ust-Nera) {.. {-9223372036854775808 34374 0 LMT}.. {-1579426374 28800 0 +08}.. {354898800 43200 0 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {764694000 43200 1 +12}.. {780418

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Vientiane

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.858039387006872
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKgTjEHp4WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKgsX
                                                                                                                                                                                                                                                MD5:D23A09C84A5368FBB47174BC0A460D14
                                                                                                                                                                                                                                                SHA1:045A72FEA79C75E5F0029BD110E33A022C57DFAB
                                                                                                                                                                                                                                                SHA-256:18F5E4FE8247F676278AC5F1912AC401DC48DF5B756D22E76FF1CFA702F88DA7
                                                                                                                                                                                                                                                SHA-512:404EABC2FC162E18C678CED063249C7FF4C28653880EA1903CE846FD191CD1C5B61E0610736F250B79BBAC768B1AFD6B9A8824D56D74591A95D7301B47D48387
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Vladivostok

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2062
                                                                                                                                                                                                                                                Entropy (8bit):3.7094518963173035
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:56beOUYQ7FyDy3le3i96VwAmnuBNuTw6vl9O8nfipRkwhUZDAcD:56cYQBIy343dVNUIukElcXRDhUBAcD
                                                                                                                                                                                                                                                MD5:5C0C094B088D0212182E7B944197D4FE
                                                                                                                                                                                                                                                SHA1:CF43A511FE9CD295207DF350704462E09D4D5278
                                                                                                                                                                                                                                                SHA-256:2558C96E25359C72F168DAC6FB3C16C54F8FD7D0724EEB1671156D4A1F42AC6C
                                                                                                                                                                                                                                                SHA-512:5D659EBDC8C2B06C964B083ECC78B4370A4658590D83F020CD23910C44E2D8DAFE69F61E8EB569E1905E89F38CD03ABE6B92F6CE36CF0B1EE0732A7645AFA65D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Vladivostok) {.. {-9223372036854775808 31651 0 LMT}.. {-1487321251 32400 0 +09}.. {-1247562000 36000 0 +11}.. {354895200 39600 1 +11}.. {370702800 36000 0 +10}.. {386431200 39600 1 +11}.. {402238800 36000 0 +10}.. {417967200 39600 1 +11}.. {433774800 36000 0 +10}.. {449589600 39600 1 +11}.. {465321600 36000 0 +10}.. {481046400 39600 1 +11}.. {496771200 36000 0 +10}.. {512496000 39600 1 +11}.. {528220800 36000 0 +10}.. {543945600 39600 1 +11}.. {559670400 36000 0 +10}.. {575395200 39600 1 +11}.. {591120000 36000 0 +10}.. {606844800 39600 1 +11}.. {622569600 36000 0 +10}.. {638294400 39600 1 +11}.. {654624000 36000 0 +10}.. {670348800 32400 0 +10}.. {670352400 36000 1 +10}.. {686077200 32400 0 +09}.. {695754000 36000 0 +11}.. {701798400 39600 1 +11}.. {717523200 36000 0 +10}.. {733248000 39600 1 +11}.. {748972800 36000 0 +10}.. {7

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Yakutsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2058
                                                                                                                                                                                                                                                Entropy (8bit):3.7081033128260934
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5h+r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2j:K5PhtjLiII2ZFlgm
                                                                                                                                                                                                                                                MD5:E43E5F0EA7C4575525BAB130984DCDCC
                                                                                                                                                                                                                                                SHA1:2D715749469FEA51A8E25D1F4F8DC4FF9178817D
                                                                                                                                                                                                                                                SHA-256:3BEF13638C46F16435D326C675907E61BB68C8173153CED3359E983BE0E413E5
                                                                                                                                                                                                                                                SHA-512:27954FEC865031BC363CFDE94E97B3B19836A6F777646EA4AAB12ECCAEE6D60A0C690711EA192B917AC717F94A01D1EF64BAE97DF968069CC12415971B070498
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yakutsk) {.. {-9223372036854775808 31138 0 LMT}.. {-1579423138 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {76470

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Yangon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):244
                                                                                                                                                                                                                                                Entropy (8bit):4.692243303623333
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2wKs5XDm2OHGVQoHvZN6FCDx+UIFDVkvScHbY/s5UIAy:MB862KTmdHGuCvZNNkkHH3Sy
                                                                                                                                                                                                                                                MD5:D45766D30074719C9A88ACE8BB53204B
                                                                                                                                                                                                                                                SHA1:69B333DFCCCCEB66DD0F7DC28B272BB10769B6B0
                                                                                                                                                                                                                                                SHA-256:2526557810747E78E713AE09BC305621A80FAEECF8D441632E7825738D4C79CB
                                                                                                                                                                                                                                                SHA-512:5255DEED72D7D13862A4D6BED7E0458C099D2EF5A1B41536CAA7C0E65A61DE8B8D1AD62AD44559F970B6613ADFB3862778D1CC99B9A05CB5BBCA7F0202B5A5B2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yangon) {.. {-9223372036854775808 23087 0 LMT}.. {-2840163887 23087 0 RMT}.. {-1577946287 23400 0 +0630}.. {-873268200 32400 0 +09}.. {-778410000 23400 0 +0630}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Yekaterinburg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2095
                                                                                                                                                                                                                                                Entropy (8bit):3.704641905144701
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:5ievNhYvm1qv7vXIovPvSvlDvtvuovKKvKcNvHvAvivBvqvvEyv8vlvEv+v4v+v+:/Nupj40H6l75FKCKcZP8qdyEaoBAWkW+
                                                                                                                                                                                                                                                MD5:D4DABA407BB8A10E4961D1DE5D9781D1
                                                                                                                                                                                                                                                SHA1:6933DE65336331BD90E2BEC6AEA0609B16DAEDC9
                                                                                                                                                                                                                                                SHA-256:2C78699EFC60758B8F8D0D1DEEDFDED5E65C65EBF3082B23E60BDEA8BF8FBCFE
                                                                                                                                                                                                                                                SHA-512:459E2187FAA66414F5CE934C335F563DFD2FA5316B86A54D1A29123A0460AFD65B7CE46629BD6A070A14CB6873A28A2F2803DE5FF4F29EA610712EB07FAD303F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yekaterinburg) {.. {-9223372036854775808 14553 0 LMT}.. {-1688270553 13505 0 PMT}.. {-1592610305 14400 0 +04}.. {-1247544000 18000 0 +06}.. {354913200 21600 1 +06}.. {370720800 18000 0 +05}.. {386449200 21600 1 +06}.. {402256800 18000 0 +05}.. {417985200 21600 1 +06}.. {433792800 18000 0 +05}.. {449607600 21600 1 +06}.. {465339600 18000 0 +05}.. {481064400 21600 1 +06}.. {496789200 18000 0 +05}.. {512514000 21600 1 +06}.. {528238800 18000 0 +05}.. {543963600 21600 1 +06}.. {559688400 18000 0 +05}.. {575413200 21600 1 +06}.. {591138000 18000 0 +05}.. {606862800 21600 1 +06}.. {622587600 18000 0 +05}.. {638312400 21600 1 +06}.. {654642000 18000 0 +05}.. {670366800 14400 0 +05}.. {670370400 18000 1 +05}.. {686095200 14400 0 +04}.. {695772000 18000 0 +06}.. {701816400 21600 1 +06}.. {717541200 18000 0 +05}.. {733266000 21600 1 +06}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Asia\Yerevan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2029
                                                                                                                                                                                                                                                Entropy (8bit):3.6487650030366106
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:5O4GeuadYlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUUUl2ue/:5xKdsUf8mFpNWFnyLCPYmPJSi3sh4
                                                                                                                                                                                                                                                MD5:2CFA7C55D0731D24679CA5D5DC716381
                                                                                                                                                                                                                                                SHA1:2BB66783D75C71E76409365757980FBC15F53231
                                                                                                                                                                                                                                                SHA-256:20871FA6AA959DDFB73D846271B4A568627B564CFC08A11BDD84B98C2F2019A3
                                                                                                                                                                                                                                                SHA-512:CAB10A48859B2C0B2CC7C56E0AA530AE7E506A4986BADC5ED974D124BD46DB328B50C423F83FCFD52D31962A249EEFC10351798B86D51EDA500F412C8D42E6BC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yerevan) {.. {-9223372036854775808 10680 0 LMT}.. {-1441162680 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 10800 0 +03}.. {733273200 14400 1 +03}.. {748998000 10800 0 +03}.. {764722800 14400 1 +03}.. {780447

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Azores

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9879
                                                                                                                                                                                                                                                Entropy (8bit):3.557602151081988
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:K35nZPOUYySoluItljncxelTMwtrayE6x5sETNek/CyNzybxYKmX6SXL/XbEcygI:K940pb6cL/b3Ldr9Q7TMq+ML
                                                                                                                                                                                                                                                MD5:E7F2A3EE0362E9ED3ECBAD24168AD098
                                                                                                                                                                                                                                                SHA1:98832274F6D9B641B809123D1272A1C04EEAA177
                                                                                                                                                                                                                                                SHA-256:6B3609BE4E93D21A2AB492594EDD387931E2C787E8471C9F2D3A677F34002D8F
                                                                                                                                                                                                                                                SHA-512:C48A76F8251AE455C759CB98802E40B3BEF716FD8E7441B6DE0242942C913367E3572B7C871082E97CA9BE67EC7DC37F8D01C438965217AC0EC36AD508DCE0D4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Azores) {.. {-9223372036854775808 -6160 0 LMT}.. {-2713904240 -6872 0 HMT}.. {-1830376800 -7200 0 -02}.. {-1689548400 -3600 1 -01}.. {-1677794400 -7200 0 -02}.. {-1667430000 -3600 1 -01}.. {-1647730800 -7200 0 -02}.. {-1635807600 -3600 1 -01}.. {-1616194800 -7200 0 -02}.. {-1604358000 -3600 1 -01}.. {-1584658800 -7200 0 -02}.. {-1572735600 -3600 1 -01}.. {-1553036400 -7200 0 -02}.. {-1541199600 -3600 1 -01}.. {-1521500400 -7200 0 -02}.. {-1442444400 -3600 1 -01}.. {-1426806000 -7200 0 -02}.. {-1379286000 -3600 1 -01}.. {-1364770800 -7200 0 -02}.. {-1348441200 -3600 1 -01}.. {-1333321200 -7200 0 -02}.. {-1316386800 -3600 1 -01}.. {-1301266800 -7200 0 -02}.. {-1284332400 -3600 1 -01}.. {-1269817200 -7200 0 -02}.. {-1221433200 -3600 1 -01}.. {-1206918000 -7200 0 -02}.. {-1191193200 -3600 1 -01}.. {-1175468400 -7200 0 -02}.. {-1127689

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Bermuda

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8784
                                                                                                                                                                                                                                                Entropy (8bit):3.833553120942514
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:ZRBHksL3zq6bCvyjvspNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/+:ft0CC
                                                                                                                                                                                                                                                MD5:B04E22B9B42722013941169B5D04DEA2
                                                                                                                                                                                                                                                SHA1:32B96A7D9504D5022A6C4E2D310E95B5F062947F
                                                                                                                                                                                                                                                SHA-256:099C3BEFBA3B4C00AE19BC53D475A52B32FAC9B36EC823C8EAEFC7D00F78F388
                                                                                                                                                                                                                                                SHA-512:8B93BCA1E923B7A43F2EB0889216E8FF991D13CB8D25BD300310ED7CD8537DBD858E8F422C9B52AE2F52F7C1CB450EF0B7C5C1B3AE547C9C1E18E2A851569DD5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Bermuda) {.. {-9223372036854775808 -15558 0 LMT}.. {-2524506042 -15558 0 BMT}.. {-1664307642 -11958 1 BMT}.. {-1648932042 -15558 0 BMT}.. {-1632080442 -11958 1 BMT}.. {-1618692042 -15558 0 BST}.. {-1262281242 -14400 0 AT}.. {-882727200 -10800 1 ADT}.. {-858538800 -14400 0 AST}.. {-845229600 -10800 1 ADT}.. {-825879600 -14400 0 AST}.. {-814384800 -10800 1 ADT}.. {-793825200 -14400 0 AST}.. {-782935200 -10800 1 ADT}.. {-762375600 -14400 0 AST}.. {-713988000 -10800 1 ADT}.. {-703710000 -14400 0 AST}.. {-681933600 -10800 1 ADT}.. {-672865200 -14400 0 AST}.. {-650484000 -10800 1 ADT}.. {-641415600 -14400 0 AST}.. {-618429600 -10800 1 ADT}.. {-609966000 -14400 0 AST}.. {-586980000 -10800 1 ADT}.. {-578516400 -14400 0 AST}.. {-555530400 -10800 1 ADT}.. {-546462000 -14400 0 AST}.. {-429127200 -10800 1 ADT}.. {-415825200 -14400 0 AST}.. {1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Canary

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6856
                                                                                                                                                                                                                                                Entropy (8bit):3.8064107143060752
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:KXVuHfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:KXVQbkIaFF1w0us4qE3+sSGjT
                                                                                                                                                                                                                                                MD5:8ABD279386C50705C074EEE18BF5AE59
                                                                                                                                                                                                                                                SHA1:C392231DBE744F5942DA4BFAC8AD0ABEBAEA0BF3
                                                                                                                                                                                                                                                SHA-256:2026944DCDEBC52F64405E35119F4CF97EA9AA1E769498730880B03F29A2B885
                                                                                                                                                                                                                                                SHA-512:3095759D01AC7EEA25E427CA38E8A0395BEFA7250E7A0C1327BF9D61F07F4570CDF7313FBE6695973EB0DD66D201C6C63591CC0DA8A1E0029926DC7056F4C95B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Canary) {.. {-9223372036854775808 -3696 0 LMT}.. {-1509663504 -3600 0 -01}.. {-733874400 0 0 WET}.. {323827200 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Cape_Verde

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):246
                                                                                                                                                                                                                                                Entropy (8bit):4.637993677747699
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/2RQ7RfDm2OHDoH1JlvQV/FFrR3FcykVvQV/FFf+nmwV:MB86267RLmdHDC1w/FH3FcyL/FomwV
                                                                                                                                                                                                                                                MD5:1581C6470850E0C9DB204975488B1AF8
                                                                                                                                                                                                                                                SHA1:6933ED13F18AD785CEDF0837F86EFAC671297A85
                                                                                                                                                                                                                                                SHA-256:2EA59ACDB5BBDD3C6ABCEEA456838A5CA57371A3D2BB93604B37F998ED8B9D4D
                                                                                                                                                                                                                                                SHA-512:9FFFA013D82CEFF6F447521C19270ECDD71152F23670164423E6013FEC46253C62D2CB79B42630BD786BD113F27369E746CA981DD17E789F7571F473B47247C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Cape_Verde) {.. {-9223372036854775808 -5644 0 LMT}.. {-1830376800 -7200 0 -02}.. {-862610400 -3600 1 -01}.. {-764118000 -7200 0 -02}.. {186120000 -3600 0 -01}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Faeroe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.709193799640151
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqLG4E23vXHAIgvMG4EeRRL/2RQqG4EZrB/4RQqG4E1n:SlSWB9vsM3yCPHAIgvoRN/2RQ1rB/4Ri
                                                                                                                                                                                                                                                MD5:601EB889A87F9CAD6F1DF4D1AB009FAE
                                                                                                                                                                                                                                                SHA1:EB43C253A48755442A67A2408D7E3295549F831C
                                                                                                                                                                                                                                                SHA-256:64FB8CAD17CD36666C7027AAD01344FEF659B13699EEF1942365842F8ED2170E
                                                                                                                                                                                                                                                SHA-512:9CFC4A446ED6A3BEF6C26AE57324F10A970EE2ADD6933130447FAD6A3DB538841F2490DD461AF5776FACD9BD2CDC4A83247DFA6B34802AE844DDC6D4C37B28EA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Faroe)]} {.. LoadTimeZoneFile Atlantic/Faroe..}..set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Faroe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6796
                                                                                                                                                                                                                                                Entropy (8bit):3.804838552487436
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:96ufXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:/bkIaFF1w0us4qE3+sSGjT
                                                                                                                                                                                                                                                MD5:F97CC7EB9C52D00177BFF4715832FCD5
                                                                                                                                                                                                                                                SHA1:CD9DCBB5E6ADD6EA91C8F142957EC229FC7F6DA3
                                                                                                                                                                                                                                                SHA-256:795F438E7F01342D5F25ECCDD09FCE65C03C5D2D561B9B5191301D57EC16B850
                                                                                                                                                                                                                                                SHA-512:9586289FEB6C597160011A47432F0AC40000483FA2E579BD89046EFD33E98DDAD652B792FD80CEDEB4CD87B6439A7B473F25F1B7375BC75353CBAF9F77E1084E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Faroe) {.. {-9223372036854775808 -1624 0 LMT}.. {-1955748776 0 0 WET}.. {347155200 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600 3600 1 WEST}.. {811904400 0 0 WET}.. {828234000 3600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Jan_Mayen

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.957633978425468
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/y+YF3vXHAIgoq8yFRRL/2RQqG0EHEcAg/h8QahV:SlSWB9vsM3ymhVoPHAIgoh6N/2RQaK85
                                                                                                                                                                                                                                                MD5:95C2D55CCE5809089CDB041EA3D464F8
                                                                                                                                                                                                                                                SHA1:B395F5F26CE979BDF2B9E2CB51C06929AED11A6C
                                                                                                                                                                                                                                                SHA-256:11BF0746F95BA01807D3B34C8FAE3FF4AE9DB5E4E6BC0CB8B36906CC3F44EDE5
                                                                                                                                                                                                                                                SHA-512:AB2BE22E95A7C36E18EBA1BB63B3930A523ED793E43A3F597A8F63AE2F0E44436C39144BC136E7E5716D7FCBFAE7F1FAF36BCFFCF9C8D51151FF25BB14D6F8B5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Berlin)]} {.. LoadTimeZoneFile Europe/Berlin..}..set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Berlin)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Madeira

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9709
                                                                                                                                                                                                                                                Entropy (8bit):3.80455694200614
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:hZUiLbMsf/ss0qKd+aKyUXtOZHY1SCOcesoQivoKbFVCdm1rXWNXyCXTOuUbkIaq:hZZDQX1rWJysukysLE3+sSGjT
                                                                                                                                                                                                                                                MD5:AC6647F9B53B5958214EC3F3B78A4D85
                                                                                                                                                                                                                                                SHA1:7355622AF99296F069F73899D5C70941C207F676
                                                                                                                                                                                                                                                SHA-256:B2A0D0DDC26806A05B2BE806CA3F938DB12A3FA40110B8B21FD3F04EFED3A531
                                                                                                                                                                                                                                                SHA-512:07569CA4D5DC6D57D91D6FDC370671A7546B73BA653D094E1B501D33570F7700727AD7FF2A083BC79E9EDE807C47E7A5604BEF5803F290B2F277C51DEF10FA6B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Madeira) {.. {-9223372036854775808 -4056 0 LMT}.. {-2713906344 -4056 0 FMT}.. {-1830380400 -3600 0 -01}.. {-1689552000 0 1 +00}.. {-1677798000 -3600 0 -01}.. {-1667433600 0 1 +00}.. {-1647734400 -3600 0 -01}.. {-1635811200 0 1 +00}.. {-1616198400 -3600 0 -01}.. {-1604361600 0 1 +00}.. {-1584662400 -3600 0 -01}.. {-1572739200 0 1 +00}.. {-1553040000 -3600 0 -01}.. {-1541203200 0 1 +00}.. {-1521504000 -3600 0 -01}.. {-1442448000 0 1 +00}.. {-1426809600 -3600 0 -01}.. {-1379289600 0 1 +00}.. {-1364774400 -3600 0 -01}.. {-1348444800 0 1 +00}.. {-1333324800 -3600 0 -01}.. {-1316390400 0 1 +00}.. {-1301270400 -3600 0 -01}.. {-1284336000 0 1 +00}.. {-1269820800 -3600 0 -01}.. {-1221436800 0 1 +00}.. {-1206921600 -3600 0 -01}.. {-1191196800 0 1 +00}.. {-1175472000 -3600 0 -01}.. {-1127692800 0 1 +00}.. {-1111968000 -3600 0 -01}.. {-

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Reykjavik

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.910514445868106
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2RQqGsA/8rVDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2RQjQD4
                                                                                                                                                                                                                                                MD5:ECB480DA99D29C0ACE67426D45534754
                                                                                                                                                                                                                                                SHA1:784CF126B030C3D883EE541877E6181F795C9697
                                                                                                                                                                                                                                                SHA-256:BDA015714260001BAE2848991DD21E802580BE2915797E5DABC376135D1C5246
                                                                                                                                                                                                                                                SHA-512:54C1B20E45C7C73354DCD4E0F4444720771820ED10B282F745DC391BEADEAEDC629BEF97B1908FB62CDAEC915D32AF1F54FC6AA9DC83E317E7CE19FC2586EF28
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Atlantic/Reykjavik) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\South_Georgia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):160
                                                                                                                                                                                                                                                Entropy (8bit):5.011466665416709
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/2RQqGtlN62/EiMXGm2OHXT14YoHvhFvdQVIyV:SlSWB9eg/2RQrlo2MiDm2OHXqYoHvTFS
                                                                                                                                                                                                                                                MD5:3B310BB8C90CA716DC1AC5A697ACA9CD
                                                                                                                                                                                                                                                SHA1:CD583F49478DCDAD91EF78539502C6FC62945C1E
                                                                                                                                                                                                                                                SHA-256:51BFABCB3388107753A3C1A8CF31118E6627132BAA09B9878D9E7CEDBEBB4886
                                                                                                                                                                                                                                                SHA-512:F593B7A1FAF0EA6B42D5EE86C20C9A8F5CD7ACD9B30EF7755E45ECAFEA8752C32E4CF4BEDF531F494E59D9F0C49CCC6FCA077292E20794AA265DFC0A56DFE579
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/South_Georgia) {.. {-9223372036854775808 -8768 0 LMT}.. {-2524512832 -7200 0 -02}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\St_Helena

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.880390141563645
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2RQqGt4r+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2RQr4rV
                                                                                                                                                                                                                                                MD5:2C73A963F515376A46762CE153AAF5C5
                                                                                                                                                                                                                                                SHA1:996C3C93DFAD89EA80AC5DFA1DFBD7CECD9ED28D
                                                                                                                                                                                                                                                SHA-256:1C9CA8966FC8BD0BE70F4A187E17E56FB99139BC88C392E82BA2E23E23111C54
                                                                                                                                                                                                                                                SHA-512:35A9ADC047DB058D71C21FC4ECB57CD14B0D9BA4416506763D1800D72CE6C9E81636F332AAD3533616F05C86F90A60416BD4065C5F832A51AA3DC186218BDCAE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Atlantic\Stanley

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2256
                                                                                                                                                                                                                                                Entropy (8bit):3.662522763865322
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:506KSBSdSs2SbSwGSyPU3lSsS5SGScSo/SkSuShSceS3SBSc7XSiSgSwSd/SJkS6:JKU+Ew0FU1TuhrR//tOIoOjXZfDWSkPR
                                                                                                                                                                                                                                                MD5:77C7ECE4FCBE150069B611C75E8DAA0E
                                                                                                                                                                                                                                                SHA1:22F4E5F15BCA92D8456B70BB36230F2605CA5E1C
                                                                                                                                                                                                                                                SHA-256:F0E99EF01F140CD5AAFE16803A657922207E6F7F6AF10B0AE795790916C302C4
                                                                                                                                                                                                                                                SHA-512:6FB57E8499A587292AFAFA9BD003721572393D5268CAF956230DA76983A112B27D6731BE561A22CCEF84935F43AC988B667C2DC404C157EA8D0E7830FC1A2AB8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Stanley) {.. {-9223372036854775808 -13884 0 LMT}.. {-2524507716 -13884 0 SMT}.. {-1824235716 -14400 0 -04}.. {-1018209600 -10800 1 -04}.. {-1003093200 -14400 0 -04}.. {-986760000 -10800 1 -04}.. {-971643600 -14400 0 -04}.. {-954705600 -10800 1 -04}.. {-939589200 -14400 0 -04}.. {-923256000 -10800 1 -04}.. {-908139600 -14400 0 -04}.. {-891806400 -10800 1 -04}.. {-876690000 -14400 0 -04}.. {-860356800 -10800 1 -04}.. {420606000 -7200 0 -03}.. {433303200 -7200 1 -03}.. {452052000 -10800 0 -03}.. {464151600 -7200 1 -03}.. {483501600 -10800 0 -03}.. {495597600 -14400 0 -04}.. {495604800 -10800 1 -04}.. {514350000 -14400 0 -04}.. {527054400 -10800 1 -04}.. {545799600 -14400 0 -04}.. {558504000 -10800 1 -04}.. {577249200 -14400 0 -04}.. {589953600 -10800 1 -04}.. {608698800 -14400 0 -04}.. {621403200 -10800 1 -04}.. {640753200 -14400 0 -

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\ACT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.862270414049974
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjpMFBx/h4QWCCj1:SlSWB9vsM3yI9kHAIgmON/2DCeMFB/4d
                                                                                                                                                                                                                                                MD5:2EF41863430897F45E0CBB51E6A44069
                                                                                                                                                                                                                                                SHA1:8E9561060E9509FAF235E5E033FC9C2918E438DB
                                                                                                                                                                                                                                                SHA-256:DF7CBDDCBB2F5926A07D19A35739E5B8DCD9733C037F7D1FF95753C28D574674
                                                                                                                                                                                                                                                SHA-512:9D3A37D64DCCCA28093C30FAB595690D021FACEC15F351A77CA33A779D645D305A2FA031869F0DE3B0404C498C2C321D3D02E4DC592D3C632F6700F5DCB54900
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/ACT) $TZData(:Australia/Sydney)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Adelaide

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8372
                                                                                                                                                                                                                                                Entropy (8bit):3.894755849491153
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:j8SY62BXovlCyRL8pJXa4NyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:j8X3Xzgl3PaN8asiQ/Uv9UnvtCaRs
                                                                                                                                                                                                                                                MD5:94E1A0C4326D09AF103107E64625CC6C
                                                                                                                                                                                                                                                SHA1:C026565F020EB158309549D98313632BAA79205F
                                                                                                                                                                                                                                                SHA-256:5C43D3152982BCFD5B9F51D0E909CF3A558BED1C270FEFFE030531D38D6F91B7
                                                                                                                                                                                                                                                SHA-512:CA08A8BC0EB740D59650FE0A9E56D9E169348AD0994F2BFFD6CCFBF9CC42E82F892FB719E80C4E2084B5702E9725C651359EE3066BD71BB19397EA83B6A68430
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Adelaide) {.. {-9223372036854775808 33260 0 LMT}.. {-2364110060 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1 ACDT}.. {320776200 34200 0 ACST}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Brisbane

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):674
                                                                                                                                                                                                                                                Entropy (8bit):4.32071371733564
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862ELmdHLOYCvSi0xT0ryRIvUr0obZv:5ELe6dvSi6L
                                                                                                                                                                                                                                                MD5:900B39F1D4AB93A445F37B6C0A8DE3D9
                                                                                                                                                                                                                                                SHA1:DE82800779DCB8094C395B5024BD01FFA3C3BB8C
                                                                                                                                                                                                                                                SHA-256:0D3C39EDAB34A8DB31A658A1549772F7D69EB57565E40AA87B707953A2D854A4
                                                                                                                                                                                                                                                SHA-512:8D115D1D14FE6FF21A4AE77E3AAC075E6A877214E568956B9A4FD2E75A46E458CAA5AE26B483F128B4C62960D73BD7543BC32F22B760059423B3D9ABCBA24B6A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Brisbane) {.. {-9223372036854775808 36728 0 LMT}.. {-2366791928 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\useren_Hill

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8437
                                                                                                                                                                                                                                                Entropy (8bit):3.902306256303896
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:QZSSY62BXovldRL8q75aANyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:QZSX3X2QfPaN8asiQ/Uv9UnvtCaRs
                                                                                                                                                                                                                                                MD5:1553DAAB804A6C9BB15D711554980D3B
                                                                                                                                                                                                                                                SHA1:5E3161B1FBB4C246DCB5E11ABD94095121CE38ED
                                                                                                                                                                                                                                                SHA-256:734F295BD0B558BDF6178DE62151B8913699D08AB2B1D101C55B8DEBC410074C
                                                                                                                                                                                                                                                SHA-512:06B21886070E39E390ECBD18841B7FDBFCA2C7C8573495D2BAA2B92EB113CD1C73C18D73C49DE3C49572CBCBCBED2FAD3248BC651BEB825A1E089B1DEDEFCBFA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/useren_Hill) {.. {-9223372036854775808 33948 0 LMT}.. {-2364110748 36000 0 AEST}.. {-2314951200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Canberra

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):195
                                                                                                                                                                                                                                                Entropy (8bit):4.851279484907769
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjnSV1+QWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DCcq+DCyB
                                                                                                                                                                                                                                                MD5:8944D3DF8FBECC03A8FB18C3B2DA3B53
                                                                                                                                                                                                                                                SHA1:6B17B38D6560592CA49840C47DB9BDA7E79F9F76
                                                                                                                                                                                                                                                SHA-256:5FE3CED97293FE0573D5ECE0CEF59CE5DDB4C57BC568AE7199E77B01D3ADE17C
                                                                                                                                                                                                                                                SHA-512:907D8BB7EA840E0B3AC683884F2F709A2C06D67CE9258BE46400A0DA63581A9B1403A44FA43E1059BE8F5C7E06F9FA05C176309AD6295317BF14F0E9FA5741E4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/Canberra) $TZData(:Australia/Sydney)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Currie

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):193
                                                                                                                                                                                                                                                Entropy (8bit):4.79231670095588
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DCkx+4DCVDy:MByMjUQVv8At2s4Ky
                                                                                                                                                                                                                                                MD5:0C1DFC0877CE8EB08007B7C2B7AF2D87
                                                                                                                                                                                                                                                SHA1:02F835BE2DA4FCA79DC2A6959BB4EB6ACC8DF708
                                                                                                                                                                                                                                                SHA-256:1DD4EC4ED4F854E2EF6162B2F28C89208710F8EC5AABB95FFA9425D3FBBCAB13
                                                                                                                                                                                                                                                SHA-512:358347045915B7D10940DB15E49528D0C636BEC1BE70129847D0B9D034F9E96E847394D88358E87D98A9E581605A3C2AB917B85FDE1296F290B4194BB7E3FA46
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Currie) $TZData(:Australia/Hobart)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Darwin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):437
                                                                                                                                                                                                                                                Entropy (8bit):4.508468081487136
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862pmdHPCvZUjMWpXgda/gd026Xgdvgd+v:5peKvZqMSX+4+56X+v+Q
                                                                                                                                                                                                                                                MD5:A81864B2C0BD7BF81F4FA21F17800059
                                                                                                                                                                                                                                                SHA1:518AC9E040A17083ED3962F4FBB47D1D83764FF7
                                                                                                                                                                                                                                                SHA-256:AC004FD4B3C536406991EC13EBB3E64E0EC0C7B264BC18C0700C8FA545868155
                                                                                                                                                                                                                                                SHA-512:3C24F4C2CC3072B3E820FCC1C68A747DCCBB9481FE743C1555783CC932DCBA44FE4851A732D24EABF62E845474D4E1278F120A04DB7549A18C7C49C31FB8D425
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Darwin) {.. {-9223372036854775808 31400 0 LMT}.. {-2364108200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Eucla

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):759
                                                                                                                                                                                                                                                Entropy (8bit):4.110997549215461
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862EmdHvOYCvV2mV22wF2nUV2CF2+V2pCwF21UF2biV2cHVKF25V2VF2cV2tFq:5Eemdvg2wQCKZ4j5c0LVmtH1iknohwQT
                                                                                                                                                                                                                                                MD5:1BC8DBD2E24606EFA49F933034FC0EEF
                                                                                                                                                                                                                                                SHA1:A511695A1B87A689C6BFF65257C11D3962FDDA3D
                                                                                                                                                                                                                                                SHA-256:79D0C770A304360DB33F3D1EF7B3935F1E4E8125893E0DCE683AC35A51302CFB
                                                                                                                                                                                                                                                SHA-512:A839D390D70F22FC833322029B732F3AE68FF48793B07005041BD12322DD6E5D5E5FF31787AA004A507A57F8FC245133891F266C4EF19D49F085E6B412E5B04C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Eucla) {.. {-9223372036854775808 30928 0 LMT}.. {-2337928528 31500 0 +0945}.. {-1672555500 35100 1 +0945}.. {-1665384300 31500 0 +0945}.. {-883637100 35100 1 +0945}.. {-876120300 31500 0 +0945}.. {-860395500 35100 1 +0945}.. {-844670700 31500 0 +0945}.. {-836473500 35100 0 +0945}.. {152039700 35100 1 +0945}.. {162926100 31500 0 +0945}.. {436295700 35100 1 +0945}.. {447182100 31500 0 +0945}.. {690311700 35100 1 +0945}.. {699383700 31500 0 +0945}.. {1165079700 35100 1 +0945}.. {1174756500 31500 0 +0945}.. {1193505300 35100 1 +0945}.. {1206810900 31500 0 +0945}.. {1224954900 35100 1 +0945}.. {1238260500 31500 0 +0945}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Hobart

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8734
                                                                                                                                                                                                                                                Entropy (8bit):3.8515786470328823
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:aOqigkx6WsYyS39nQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:aOq05hnQiAmcOM6e0pj
                                                                                                                                                                                                                                                MD5:5E04BF8E1DEBFCC4130FDD1BBD67B2DF
                                                                                                                                                                                                                                                SHA1:796AADCE7BB2FAF5E6FC916C941A4E3DCAFACC9E
                                                                                                                                                                                                                                                SHA-256:D813F6A97BEFC22CA4F24C59EB755D269B9C68A449CC7CF0D2C61F911860EBE7
                                                                                                                                                                                                                                                SHA-512:3A69CF1D1F57D6BD39E5F4DAF76BBB06A749D42BEB29452A0A5BDAA68F5DACC0DF176EDDA7A083F5B5B84FC651926C09D46CAAD2F6C4F1595AB9CCA1A958D653
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Hobart) {.. {-9223372036854775808 35356 0 LMT}.. {-2345795356 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-1646640000 39600 1 AEDT}.. {-1635753600 36000 0 AEST}.. {-1615190400 39600 1 AEDT}.. {-1604304000 36000 0 AEST}.. {-1583920800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AES

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\LHI

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):199
                                                                                                                                                                                                                                                Entropy (8bit):4.912882643701746
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yIoGEoPHAIgjGg6N/2DCkx/2DCPGUv:MByMjeXV6t2a8v
                                                                                                                                                                                                                                                MD5:425DC7B1E31F4AA41DAD74E3C9AE3562
                                                                                                                                                                                                                                                SHA1:D92A3269F7BF5EC00F082C64CEF6E20C43017180
                                                                                                                                                                                                                                                SHA-256:4D84E4040FBC529C9E0366BB74D0CFADEEEEDA0DFCC6C2C9204DED6C6455CAC3
                                                                                                                                                                                                                                                SHA-512:F3031F16C0D00D9F8A38CD378F599EB3E63F4FF85F120DB38E3013E93F08E6F512D969F164BBC88CD625910FB3E086F3352E5B8FFC1373C3CC98F363FB3FD3F7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Lord_Howe)]} {.. LoadTimeZoneFile Australia/Lord_Howe..}..set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Lindeman

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):824
                                                                                                                                                                                                                                                Entropy (8bit):4.249672335529665
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862gtmdHVCvCi0xT0ryRIvUr0obbty/ywtUj3yv:5gteMvCi6Xlt8
                                                                                                                                                                                                                                                MD5:504A422280E0459A2126E7CB02F527E6
                                                                                                                                                                                                                                                SHA1:EF61B98EFB1E44EE59020E99A69EA67D6B8ACFC2
                                                                                                                                                                                                                                                SHA-256:01B278309353849CC2FDF62A30E2FF483833D5713CF5E329252738BE6F2C0A84
                                                                                                                                                                                                                                                SHA-512:BFDAAD56D817CD3AAB17DFD0A33EFDD422645BC542ABE269C0F8520E33796DF4F19EAB2E40BFC6C4AF93EF654239B8F2E285639B4662040D865B9C340A23CFAD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lindeman) {.. {-9223372036854775808 35756 0 LMT}.. {-2366790956 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}.. {709912800 36000 0 AEST}.. {719942400 39600 1 AEDT}.. {731433600 36000 0 AEST}.. {751996800 39600 1 AEDT}.. {762883200 36000 0 AEST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Lord_Howe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7764
                                                                                                                                                                                                                                                Entropy (8bit):3.5615258807990537
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:pmz39IyKxb/JbcD9gKniAF23QbNS1fEGXALNbbT2JFJ/FaKaTQ9ZJhRVK:p+cpVKniAF2AbkFKL
                                                                                                                                                                                                                                                MD5:10F983F4683CDE13A1228AC0B04D8513
                                                                                                                                                                                                                                                SHA1:45378BA5949BE53D698108F50FECFF50C9E3D296
                                                                                                                                                                                                                                                SHA-256:76D1F1ED67B8F8D6903789C2FDDF79590A83677972D416F5F3C9687614EC6238
                                                                                                                                                                                                                                                SHA-512:D60D802EF215A33750E4F859657BA12A67084B1E9FCF1B4A7CEEE7B9D816BC2C6670775D93C88EC8380CDD7790AD574133D6F90F0828F848313C26583B2F196A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lord_Howe) {.. {-9223372036854775808 38180 0 LMT}.. {-2364114980 36000 0 AEST}.. {352216800 37800 0 +1030}.. {372785400 41400 1 +1030}.. {384273000 37800 0 +1030}.. {404839800 41400 1 +1030}.. {415722600 37800 0 +1030}.. {436289400 41400 1 +1030}.. {447172200 37800 0 +1030}.. {467739000 41400 1 +1030}.. {478621800 37800 0 +1030}.. {488984400 37800 0 +1030}.. {499188600 39600 1 +1030}.. {511282800 37800 0 +1030}.. {530033400 39600 1 +1030}.. {542732400 37800 0 +1030}.. {562087800 39600 1 +1030}.. {574786800 37800 0 +1030}.. {594142200 39600 1 +1030}.. {606236400 37800 0 +1030}.. {625591800 39600 1 +1030}.. {636476400 37800 0 +1030}.. {657041400 39600 1 +1030}.. {667926000 37800 0 +1030}.. {688491000 39600 1 +1030}.. {699375600 37800 0 +1030}.. {719940600 39600 1 +1030}.. {731430000 37800 0 +1030}.. {751995000 39600 1 +1030}.. {762

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Melbourne

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8341
                                                                                                                                                                                                                                                Entropy (8bit):3.8532171550973526
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:Yyigkp2EUyn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:Yy3VnQiAmcOM6e0pj
                                                                                                                                                                                                                                                MD5:40D06B80A4A0DB415270EFD9698B97BF
                                                                                                                                                                                                                                                SHA1:1999F0E8C7EBAA11BD21D64D9E07FA911F13C64C
                                                                                                                                                                                                                                                SHA-256:F21B9EA51C0D41BAD0420FE0601E5A4B491FB895856F4BDDF6541D704469D92F
                                                                                                                                                                                                                                                SHA-512:E47D597CC85D177CF2804C44C216EB4C5B74472457F15F697704311A847BF8A051DCAFD26FA61DD689555F35640151E26F25D5DC5319EFEFEA62AD86657A4A95
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Melbourne) {.. {-9223372036854775808 34792 0 LMT}.. {-2364111592 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\NSW

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.893713405897538
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjREeQWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DC5eDCyB
                                                                                                                                                                                                                                                MD5:80B7CDD1EA5A5308CE84C038180005F2
                                                                                                                                                                                                                                                SHA1:B7CA15B58ADA8CA3EB74B7971073022D57D8EE70
                                                                                                                                                                                                                                                SHA-256:73D7C9E207E61ACF8DF7242BDCD84488189033E22A84873A953B65DE02FA1B0B
                                                                                                                                                                                                                                                SHA-512:F627F5FF335600AC9158D6A0D3694AB7E70180177449C17B5605BBF7B1B7F8FB447A9C207F4E1BCB627074DB47B8A66F5D78E03C6DB8FA17F8BDD6AABB331665
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/NSW) $TZData(:Australia/Sydney)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\North

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                                Entropy (8bit):4.830368875485429
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjbvvXHAIgoXjbBvRL/2QWCCjsrQWCCjbi:SlSWB9vsM3yIFHAIg2N/2DCZrDCl
                                                                                                                                                                                                                                                MD5:14CB7EA1C028F457345EBEB8ADDC9237
                                                                                                                                                                                                                                                SHA1:208BF676F56533BA271D1B98363A766DF17CF6F2
                                                                                                                                                                                                                                                SHA-256:A983C9CAD7E542CAED43B083E68CD2B782959A4B54015F374C29250D3ACF9B8D
                                                                                                                                                                                                                                                SHA-512:099F65E5FA705FD7257CF7B8E103905EE313C6D082844F69CCD3F318E3E7F4098B29F952FA0AA28655E1FE290A0FB2E809911088315889DE7CAAF0E04698C2FC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Darwin)]} {.. LoadTimeZoneFile Australia/Darwin..}..set TZData(:Australia/North) $TZData(:Australia/Darwin)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Perth

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):739
                                                                                                                                                                                                                                                Entropy (8bit):4.31793586514766
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB8623mdHCBdCvmlXz6zezzOz4iaLYvzkzi4zm5fVcBhg8mfev:53eCB0v4+e3Oz4iaLYbkzi4zxhfqw
                                                                                                                                                                                                                                                MD5:01B1A88867472AD60B8F5C0E1648E3ED
                                                                                                                                                                                                                                                SHA1:9975EA750458E8061DD8A83585675CB7E4910CA6
                                                                                                                                                                                                                                                SHA-256:FC1B54CA261074E47A8A486FEAC12DD04D46166D1D2B44163BD8791BEC32D275
                                                                                                                                                                                                                                                SHA-512:20BDFBCD1A5038C81552EBD955F3921DE3447A1F30E64935937768B2B98735AE53049601DCDD2D519646C78E6D03289EB465CFF4F2DADEA7D89A329504C6C475
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Perth) {.. {-9223372036854775808 27804 0 LMT}.. {-2337925404 28800 0 AWST}.. {-1672552800 32400 1 AWDT}.. {-1665381600 28800 0 AWST}.. {-883634400 32400 1 AWDT}.. {-876117600 28800 0 AWST}.. {-860392800 32400 1 AWDT}.. {-844668000 28800 0 AWST}.. {-836470800 32400 0 AWST}.. {152042400 32400 1 AWDT}.. {162928800 28800 0 AWST}.. {436298400 32400 1 AWDT}.. {447184800 28800 0 AWST}.. {690314400 32400 1 AWDT}.. {699386400 28800 0 AWST}.. {1165082400 32400 1 AWDT}.. {1174759200 28800 0 AWST}.. {1193508000 32400 1 AWDT}.. {1206813600 28800 0 AWST}.. {1224957600 32400 1 AWDT}.. {1238263200 28800 0 AWST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Queensland

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):203
                                                                                                                                                                                                                                                Entropy (8bit):4.803539644461131
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yIaWhSHAIgPWAvN/2DCoRWJvFBx+DC7WN:MByMjL9t2rOvFel
                                                                                                                                                                                                                                                MD5:401B6B2E30EF17BE20212645287EB94B
                                                                                                                                                                                                                                                SHA1:67D15A45C61122CE680B829FE0FA3A1C501A8C8F
                                                                                                                                                                                                                                                SHA-256:DDA669B9BFB3E08FC23CE67030148B9E4740824ADD8DE02580D6AFD31CE05BAB
                                                                                                                                                                                                                                                SHA-512:F4348F8F4FF261C47854725AEE4E14E7E334B3C31496E5C46B0E0041551CB6861380E684E8888AFE9DA7E8E97236AC322B9CE2738EF245E9D46C9681665F83A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Brisbane)]} {.. LoadTimeZoneFile Australia/Brisbane..}..set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\South

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):198
                                                                                                                                                                                                                                                Entropy (8bit):4.752918480727309
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yIDRpGSHAIgSRrN/2DCa7QDCuRpyn:MByMjdpQYrt23QHpy
                                                                                                                                                                                                                                                MD5:D226A0718185854DFE549E00856AA8D5
                                                                                                                                                                                                                                                SHA1:94EE96FAE259D90C2FDF169DD95BD82B3171FFAE
                                                                                                                                                                                                                                                SHA-256:D9DCFDC377901EC0C0FEB9CEA743C2C1425273F69A1BAA7BF3B74FEC5885B267
                                                                                                                                                                                                                                                SHA-512:7EE29A7235CAAEF4889246B7A2241CA9A0D5D2B2E1D56B20141247C93B8736F17280F0D46004AC4588E137D1E76F661C779C906BBFC2B5F8FA73C19F7657F952
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Adelaide)]} {.. LoadTimeZoneFile Australia/Adelaide..}..set TZData(:Australia/South) $TZData(:Australia/Adelaide)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Sydney

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8338
                                                                                                                                                                                                                                                Entropy (8bit):3.847525715050911
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:AZJigk42/yn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:AZJuVnQiAmcOM6e0pj
                                                                                                                                                                                                                                                MD5:C0F1776E011C4C86B7709A592E7CA1EB
                                                                                                                                                                                                                                                SHA1:1CA528D529BF4995E145D6E0D87A8752A3577E7F
                                                                                                                                                                                                                                                SHA-256:FC453486325ADE1D31F14087B76D4936F3A6D551ABD1DB6FCAC129BDB043951C
                                                                                                                                                                                                                                                SHA-512:F872182962C2615A35F012ECAB30C88F07C6BEF0261207AD52706DB22D8CDD0DA65723CD801FDA7C548C5EB0ECFC39DD66CC17503BAA3BBB77BFA35D20650E4F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Sydney) {.. {-9223372036854775808 36292 0 LMT}.. {-2364113092 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Tasmania

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):195
                                                                                                                                                                                                                                                Entropy (8bit):4.777331394201868
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DC3neDCVDy:MByMjUQVv8At2+eKy
                                                                                                                                                                                                                                                MD5:9C58D9EFBB03472BBDA76CE2FFAD4BB4
                                                                                                                                                                                                                                                SHA1:30959E3681B64AE26F7FA3957887896C26AF7F19
                                                                                                                                                                                                                                                SHA-256:C94FA7A7640CD00963EE8FF1A3D9DCDA2075408739D998EDBF7CFC998DB764FD
                                                                                                                                                                                                                                                SHA-512:2D6B778217726691F2CB4A4995A8B1AB08DDB7FE4570A3FD04EF54F718F455EF3CBD4EEF1A1BCC99A2088C82A6E89DB455BAF1327CECD6BF608837E50F14A6C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Victoria

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.818875198673406
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yIvFfkSHAIgoFNNvN/2DCzyQDCMF4:MByMj9fKaNNvt2xQz4
                                                                                                                                                                                                                                                MD5:0B144A2E47C81354BC510BC741DE5150
                                                                                                                                                                                                                                                SHA1:A7396F1741F02C6C208FD1286362E4E0720198B8
                                                                                                                                                                                                                                                SHA-256:DBEF9C5BDD290FEC5FA740D697143332D3CA1FC373CF1DF736F1883AC9BA3298
                                                                                                                                                                                                                                                SHA-512:562B029591F9ADB8C324BA56E849B2B524E91B26D3DB441510194882A8E1E63E6948D041874A00A0A76F29925A1CEAC53DD2AE5D7F23123B6FE919346CBFD8CC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Melbourne)]} {.. LoadTimeZoneFile Australia/Melbourne..}..set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\West

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.831654343064909
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjXFeyXHAIgoXjrWARL/2QWCCjH0QWCCjQ:SlSWB9vsM3yInHAIgOWAN/2DC00DCt
                                                                                                                                                                                                                                                MD5:5F5916CB038876BE27AA5E2AD74EE085
                                                                                                                                                                                                                                                SHA1:18AC21B638188B542455BA3DA91F958DF1724E68
                                                                                                                                                                                                                                                SHA-256:75ABB7F20C4A0B618138AA190AF33CEAF2A6D2C707DA6C1314E4BFF2F9904F58
                                                                                                                                                                                                                                                SHA-512:ADFD83E292AC1BB5E19255A9B2DA0E3BB9323A5F9B92D458DE34C291D7F9B6CFBBF62AA3351FB320E54F34305DD485ADC72134D21AFA6A27B2B8B7D93DCA2113
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Perth)]} {.. LoadTimeZoneFile Australia/Perth..}..set TZData(:Australia/West) $TZData(:Australia/Perth)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Australia\Yancowinna

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):212
                                                                                                                                                                                                                                                Entropy (8bit):4.918079927018121
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yIcKlHAIgJK3N/2DCkuM0DC9KM:MByMjcKeJK3t2kVSKM
                                                                                                                                                                                                                                                MD5:BEDEA56FCE4B2F0A3F3E9319856A5560
                                                                                                                                                                                                                                                SHA1:9FD0FE998A003C6B4CCCD00A977153347DE07F55
                                                                                                                                                                                                                                                SHA-256:55A9264D0414644A1BE342106AE86086A6659596DC9322A74FC4D1DDB41F7C60
                                                                                                                                                                                                                                                SHA-512:7C438B72262B99EDEEB31AC95E0135BB722A3B0B049278B6DE67DB5FB501837FB9C03785233B538E83F4B56104F6EA3B3DA0F7C2275E0F78F232161840AA4C63
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/useren_Hill)]} {.. LoadTimeZoneFile Australia/useren_Hill..}..set TZData(:Australia/Yancowinna) $TZData(:Australia/useren_Hill)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Brazil\Acre

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):194
                                                                                                                                                                                                                                                Entropy (8bit):4.888429541699473
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7thteSHAIgpth9RN/xWh490th4:MByMYdIp7tQ490I
                                                                                                                                                                                                                                                MD5:A8A7A10DA4321819ED71F891480770F8
                                                                                                                                                                                                                                                SHA1:930674EF7711542D7F471A59C1870D4576E027FD
                                                                                                                                                                                                                                                SHA-256:2F594239A434052D36053A2B3EAB134EADBAD06EB6737E67CF72166DAB157537
                                                                                                                                                                                                                                                SHA-512:C6AD1869A713DDE0E4DE53F7894E5CE0B7AEFDDD7C5C3D83BB5B92FB7D8E20B373A6694045053E1AE8EA98A7B7D0C052EF2C21310E47DC650A7A399A5F73D586
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Brazil\DeNoronha

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.875339623736144
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wKy4oeyXHAIg20wKARL/1bIAJl0IAcGEwKyovn:SlSWB9vsM3y7/rDSHAIgp/AN/xIAE90j
                                                                                                                                                                                                                                                MD5:E0D0EFBEC37E27532B49FF6DD9893DA0
                                                                                                                                                                                                                                                SHA1:9C00993A885AF448E48201A46E17629A7A602FC6
                                                                                                                                                                                                                                                SHA-256:A676562A90FF8587A775F6F0E3BE05D870456A56D25B5330816BF9043C8D475B
                                                                                                                                                                                                                                                SHA-512:AB0E6907F9C0002CA5C050A0069AF013B14BADA08CA4553C96B302C078DF7629D5D7EDE4A19A53DEC6E7B9E6D9857F14EC7A1DB9BC11F2EEC9FFBAC70E129EEE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Noronha)]} {.. LoadTimeZoneFile America/Noronha..}..set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Brazil\East

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):191
                                                                                                                                                                                                                                                Entropy (8bit):4.948480276987682
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0tQJXveyXHAIg20tQJE6RL/1bJHIAcGEtQJXy:SlSWB9vsM3y7tIGSHAIgpt36N/xR90tF
                                                                                                                                                                                                                                                MD5:FCCB5F44903E1B988A058E5BBF5E163B
                                                                                                                                                                                                                                                SHA1:E1CC03DD4A804C7305D8B0C12D8451D08AE262EA
                                                                                                                                                                                                                                                SHA-256:961FB3AB99A63B1E9704B737EAB2D588B5A39D253A213E175CC678BEDFFD498D
                                                                                                                                                                                                                                                SHA-512:F31C80E4AD6EBE6CB8A3382E0052DC47601D073E8F81375D50241105675AA3AB45433FFD0534524D9992ABE1086C6671D85FF7C72B0D6766EB9984426F608B77
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Sao_Paulo)]} {.. LoadTimeZoneFile America/Sao_Paulo..}..set TZData(:Brazil/East) $TZData(:America/Sao_Paulo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Brazil\West

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.902113962502196
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0znQZF3vXHAIg20znQv5RL/1bbAWVIAcGEznQe:SlSWB9vsM3y7zn+PHAIgpznSN/xn90zN
                                                                                                                                                                                                                                                MD5:9F4B43F4F27D0B7EAC0C5401A1A794B4
                                                                                                                                                                                                                                                SHA1:2A8543B994E93E54BD50EAA78463905E6A8EBE74
                                                                                                                                                                                                                                                SHA-256:0500C9A248C8CE9030EA30D0AF9DD95DC465480BAF60646C0B7C511FA23C6D1F
                                                                                                                                                                                                                                                SHA-512:0ADAF708ACFBD80F4704951EEBC24AD144FD5856997A429279E804F3A7F7F9A8FED41DCEE85BFB1ECDBF1E05137E87E7430186474BCF5DE42067FFC74746F048
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Manaus)]} {.. LoadTimeZoneFile America/Manaus..}..set TZData(:Brazil/West) $TZData(:America/Manaus)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\CET

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7736
                                                                                                                                                                                                                                                Entropy (8bit):3.7984816540097843
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:09+xKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt7:9Ss41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:6DB983AD72FB2A88FC557BE5E873336F
                                                                                                                                                                                                                                                SHA1:C64E988010087ED559A990B3D95078949C9B4D72
                                                                                                                                                                                                                                                SHA-256:E2AEA7CFD428A43D9DB938BCC476623ADC1250BD8057013A7FFF5F89D7FF8EFC
                                                                                                                                                                                                                                                SHA-512:C0A646F80FB2FD42D9146A4FD36CF5A7F62016684F8D5AF80453EC190F4AEA65EDADC5BCF071AE746ABFB43B29C27B2743F2152B6986D41BFDE1617CA774A7C5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:CET) {.. {-9223372036854775808 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766623600 3600 0 CET}.. {228877200 7200 1 CEST}.. {243997200 3600 0 CET}.. {260326800 7200 1 CEST}.. {276051600 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\CST6CDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8505
                                                                                                                                                                                                                                                Entropy (8bit):3.8095769056779916
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:e3HgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:eQaUqtfA604qSBgI7DBch
                                                                                                                                                                                                                                                MD5:A6F88C55E8613A27DE3E6C25B0672910
                                                                                                                                                                                                                                                SHA1:3B593CC17BF153A6209FC5AACE7B88DA9603BD44
                                                                                                                                                                                                                                                SHA-256:73A9841F233AA657AFB6CED8A86A37D55FE5582DD996B9B28975D218BCCC078F
                                                                                                                                                                                                                                                SHA-512:526A922B1594A2800B03F363F7BFEC29203D4A4F2B49C5F2618469F59176CE4F8AFBA0616B226AC39D308DB05DE7147714D9B6CDBB2EA7373A041A4D47F50E2E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:CST6CDT) {.. {-9223372036854775808 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-84384000 -18000 1 CDT}.. {-68662800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Atlantic

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.804821796604604
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/0nalGe2IAcGE2NEOyn:SlSWB9vsM3y7UEOXHAIgpUEqA6N/0af9
                                                                                                                                                                                                                                                MD5:33A04963E70EBF29339204348E0DF874
                                                                                                                                                                                                                                                SHA1:456C0DB88ECE4D180EEE5AE5AEF5FBEB6E977D00
                                                                                                                                                                                                                                                SHA-256:6DC6354D761CBE7820C9186568CAB87AD48CA925507F6A740357195B60E16D87
                                                                                                                                                                                                                                                SHA-512:DF8F46827760BD7EC922C6837E0B6649B4FBD220B79E6F1B67FE3DD8CB3D2D035ECDAF4CF6CE5BDE6DC79C6F7B6EE2B9787AF08A97845CD0D647720A2E78D7EF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:Canada/Atlantic) $TZData(:America/Halifax)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Central

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):191
                                                                                                                                                                                                                                                Entropy (8bit):4.863241040396457
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0po/vXHAIg20puFvHRL/0nPQox/h4IAcGEpoyn:SlSWB9vsM3y7pYHAIgppuRN/0d490pl
                                                                                                                                                                                                                                                MD5:97E50CE9FBA3F1A6DFCF333F9E6D592C
                                                                                                                                                                                                                                                SHA1:EE472C411079E788DBF32FAC9C5B7EE121960DC2
                                                                                                                                                                                                                                                SHA-256:DB32E83949D62478D229E9FB57BB1624D21B3A9CCEE4CD55335F8262C01D820A
                                                                                                                                                                                                                                                SHA-512:D547E3DC03848A677BE67F7CF4124E067F76EE09BB724A5B10F028BEA72C1526B17678A035B2C53F69498E9ECAACD3C5445D42B7FE58DF706DD2C5F2ADA05A73
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Winnipeg)]} {.. LoadTimeZoneFile America/Winnipeg..}..set TZData(:Canada/Central) $TZData(:America/Winnipeg)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Eastern

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.758562813220951
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/0nbHboxp4IAcGEqM:SlSWB9vsM3y7RQtHAIgpRQPN/0Dboxpp
                                                                                                                                                                                                                                                MD5:4365BEFA3D50EEE20843EF97A095E512
                                                                                                                                                                                                                                                SHA1:7756049B4CD6459742686925E9516E64A9727306
                                                                                                                                                                                                                                                SHA-256:22844994AE893F3236A091B050E932E84A5218EC0D01F72595E17CCC471FA564
                                                                                                                                                                                                                                                SHA-512:CB265E79DF926026BEBF7158590369ABE5353C759540F509ABBA2A7ADBE59A705BC2AB936F400614BE610EDB761DE9A2B1E179A0A8B0A87E595392362C2516AA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:Canada/Eastern) $TZData(:America/Toronto)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Mountain

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                                Entropy (8bit):4.8181126338833655
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx07nKL50vXHAIg207nKLyRRL/0nNYLo/4IAcGE7nK1:SlSWB9vsM3y77G2HAIgp7bN/0W8/4908
                                                                                                                                                                                                                                                MD5:FA0D0024AD72CCE4EC7229FA897FB1B7
                                                                                                                                                                                                                                                SHA1:4373A07F2674FE974189CC801987652AA97F0204
                                                                                                                                                                                                                                                SHA-256:D7A203E60FF19DCDEAAD14121720DE51DA73392D25B40FFA301C1935CDF89517
                                                                                                                                                                                                                                                SHA-512:82EF7F429604A69734B04D298B4C9C9AC3BE57B9DD8C4CECF59C7AB3470BDFBA0505886C4E6AA3864F5EC7FBB4C69C54CF153A6417376828234833013C29A0C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Edmonton)]} {.. LoadTimeZoneFile America/Edmonton..}..set TZData(:Canada/Mountain) $TZData(:America/Edmonton)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Newfoundland

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):196
                                                                                                                                                                                                                                                Entropy (8bit):4.998628928230972
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7tgYJHAIgptVN/0xdBx+90twv:MByMYnKpTt590g
                                                                                                                                                                                                                                                MD5:A2DCCB8BFC65DD4E7C3BB7F10DCEFF11
                                                                                                                                                                                                                                                SHA1:6FD2F4FAE06C5D4D3F189A167A98AA76497569DD
                                                                                                                                                                                                                                                SHA-256:87F42F45FD7D059CA47650D445420DE8320F3A7C1CBC7671FBFA8A8881274433
                                                                                                                                                                                                                                                SHA-512:F42E32C5BD785BA914E5054784BF67DDF951460A708290D1899621CEEDC63475B584FC052A86A3B6D45BF3C651D42427FB6F9CE2A2A33764DFFF731053BECC16
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/St_Johns)]} {.. LoadTimeZoneFile America/St_Johns..}..set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Pacific

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):194
                                                                                                                                                                                                                                                Entropy (8bit):4.887587766811186
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7ZLgXPHAIgpZLgFN/0N290ZLgK:MByMY13p1stx901/
                                                                                                                                                                                                                                                MD5:68900CE38FE0E40578323BBD3D75184E
                                                                                                                                                                                                                                                SHA1:9D5EAB5CBCD495DD46974207FBE354A81DD2070F
                                                                                                                                                                                                                                                SHA-256:5C4FD46054B190A6D4B92585B4DAE4E3A8233EE2996D14472835DDD264911DC6
                                                                                                                                                                                                                                                SHA-512:3EF53F0FCD8D88A1B977886BDFAA03D7B84EF021AC6BEDF7C571BFBF2242BFC3F3EB6A6B6A9C2F6852AF412A96DFBC30F3BB25A6619CBCD8736F3DF5B64DE1BF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Vancouver)]} {.. LoadTimeZoneFile America/Vancouver..}..set TZData(:Canada/Pacific) $TZData(:America/Vancouver)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Saskatchewan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.887593462838566
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/0nogS64IAcGEsAzEB:SlSWB9vsM3y7hzi2HAIgphznN/0Hd499
                                                                                                                                                                                                                                                MD5:A4237BDCAF68B0EFECA97178F3DEE724
                                                                                                                                                                                                                                                SHA1:A9CBC02B5545A63A0C9B38C8FA7FA2DE6D483188
                                                                                                                                                                                                                                                SHA-256:46BA00AE3A07A4DC83D6CB517D87C9CBBA491B3421FE9AD6C74CAC5695EB73F7
                                                                                                                                                                                                                                                SHA-512:832BF256BE8CB2DD205DDE50017448D5830B46FF4DCA77BDB852067EE0C9DF9977014F2A3E3DD6944336158D8EA377CFBBE519EE5B56FB26EB64325B45476B9D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/Saskatchewan) $TZData(:America/Regina)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Canada\Yukon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):195
                                                                                                                                                                                                                                                Entropy (8bit):4.889486451014262
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7peR2fkSHAIgppeR2rN/0CF/490peR24:MByMYkGk7pkOtBQ90kB
                                                                                                                                                                                                                                                MD5:490D99BD5465CBF5A8FE28F33180B8A6
                                                                                                                                                                                                                                                SHA1:4783295C31A804BE98145270ED28956A0783E655
                                                                                                                                                                                                                                                SHA-256:A1B1AF37DC89C6BA663E4E967A18409AE4E0FA9EF1B908D0461368DA31001C09
                                                                                                                                                                                                                                                SHA-512:9F6B4F204A21B69E1DFCB766C0671D3736414C73269DCEDCDB4FC3DBA869BBA1511DF6B5061F8964F0AF9C3816133D04E5DFB8A6AD07CA06E7712787A8FECC5A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Whitehorse)]} {.. LoadTimeZoneFile America/Whitehorse..}..set TZData(:Canada/Yukon) $TZData(:America/Whitehorse)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Chile\Continental

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):194
                                                                                                                                                                                                                                                Entropy (8bit):4.812019117774239
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7tfEJkHAIgptfEJo5N/0rHM490tfEJB:MByMYE9pEOt4X90EB
                                                                                                                                                                                                                                                MD5:6EF54792279C249B16877100682F1806
                                                                                                                                                                                                                                                SHA1:A62629EA055207D917740E3AEF4F0B005EA49CC4
                                                                                                                                                                                                                                                SHA-256:5B40167DD0C0B5C293861070C4AC249F78DDF8BAD798DD0165E3AE894C9B9570
                                                                                                                                                                                                                                                SHA-512:3CF93003C3EA2B4386660F0C87074F9AE2BAC4EE72D88451DCB1EA8B79502D2187B1608B6D5CE8D7EDC00AED99CF9DB7B006EB6ED2A2B5009F2C0E757D282D74
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Santiago)]} {.. LoadTimeZoneFile America/Santiago..}..set TZData(:Chile/Continental) $TZData(:America/Santiago)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Chile\EasterIsland

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.808907056781067
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG7ZAJWXHAIgObT7ZAiFvRL/0bxOdBx/nUDH7ZAZv:SlSWB9vsM3ycJAUHAIgObJAiRN/04dBn
                                                                                                                                                                                                                                                MD5:2EC4FDD1EFBAF1D9F9DBAC8B1B5EDD09
                                                                                                                                                                                                                                                SHA1:FECED8EBC7B666628B7B45C9694FCB3A0B20A42A
                                                                                                                                                                                                                                                SHA-256:1E2DA1862E0E0F131B7C6EB12FAC5F920852C61C162993A30BC843A464A5AAD4
                                                                                                                                                                                                                                                SHA-512:74D61141505BAF1ABAD61FB91941C63C169EFE3C85829FEBB4D29A72EA54D1A07EC84E2E9B48E963E65CBF7663245459FAD288D620B1BEFFE682A2D1C243794D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Easter)]} {.. LoadTimeZoneFile Pacific/Easter..}..set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Cuba

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):175
                                                                                                                                                                                                                                                Entropy (8bit):4.857134440822812
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx02TEMVFfXHAIg202TEyRRL/0lIAcGE2TEMy:SlSWB9vsM3y76EkHAIgp6EyRN/0l9068
                                                                                                                                                                                                                                                MD5:3FB16EA4A9B0529220133C4A7B05215B
                                                                                                                                                                                                                                                SHA1:BD56B6E76A92A5925140CB5CC3D940E1DE90993F
                                                                                                                                                                                                                                                SHA-256:6F4F2D7F5BCA4E5183460C0153D2B98F5239A99F149DE6638B311C73CEDB1329
                                                                                                                                                                                                                                                SHA-512:690EC1BCE7FA979BD55725B8ED6DF042BB331CAD332827B2C64B31F107539934AA5A30268B1F03D52697528E68A1BA72E4D56B5199A68B1ED897B75FAFB33A8A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Havana)]} {.. LoadTimeZoneFile America/Havana..}..set TZData(:Cuba) $TZData(:America/Havana)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\EET

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7440
                                                                                                                                                                                                                                                Entropy (8bit):3.695300167191082
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:CgDIMcVbf+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlt:KlfyDjivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:34339D40AC889DCB5A09D10F123175AD
                                                                                                                                                                                                                                                SHA1:57E1F70FA8999106FA3874A9CE1E75A7ACBC81E9
                                                                                                                                                                                                                                                SHA-256:64E284F9F7A36CC0A352809141D76E73A99344A9F30CFFEA254CBB9D2C589ADA
                                                                                                                                                                                                                                                SHA-512:2DCF16D9D7593FC3E5844E18FD689AADA157866490CFD37A38A47F747DDA189822055F6DD470CA2D77040D2C5A2527512880C22ED8EC16D9424EDF3DC228AFED
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EET) {.. {-9223372036854775808 7200 0 EET}.. {228877200 10800 1 EEST}.. {243997200 7200 0 EET}.. {260326800 10800 1 EEST}.. {276051600 7200 0 EET}.. {291776400 10800 1 EEST}.. {307501200 7200 0 EET}.. {323830800 10800 1 EEST}.. {338950800 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 E

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\EST

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):111
                                                                                                                                                                                                                                                Entropy (8bit):4.924838898127838
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yLbNMXGm2OHLVva0v:SlSWB9eg/ylDm2OHLVi0v
                                                                                                                                                                                                                                                MD5:B221E7141FFC9DEA317F64F81C7BB4E0
                                                                                                                                                                                                                                                SHA1:B13BBDE790B169D8B9075275523F319D5173E2C7
                                                                                                                                                                                                                                                SHA-256:6344BE02529C1CC5F7B5FE14B7E9BBCED4DDE68A24B824601EEBCAE207ABFDF2
                                                                                                                                                                                                                                                SHA-512:FFFA733476D6C7DCF49C0B88C9F5E381DE2B69BAEDF6C7B1D91C6F45CE2D36E06D40F25B6BB65D4B5D650471BB52CD2EC3F68703DAB4BD5414F8D3F831D92BD2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EST) {.. {-9223372036854775808 -18000 0 EST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\EST5EDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8505
                                                                                                                                                                                                                                                Entropy (8bit):3.8091719283634853
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:R+kNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:RXoSItON0HY2iUmUFLqU
                                                                                                                                                                                                                                                MD5:4578FE48781599B55F4BCF5560019789
                                                                                                                                                                                                                                                SHA1:4EAA7134621DFDEBFD1405F5CC58227FA7E80C3A
                                                                                                                                                                                                                                                SHA-256:0BE6161403BC5A96BFAB174F2C3FCBA8A677D4349699B408E9872B9DD0FE15CE
                                                                                                                                                                                                                                                SHA-512:9ACC2EF396F635D22E3DF6B785831AD74B510049F1BE85F996467A5BBC0DF49A28B2FC3E4CA0CA9DC8FC2C29EA50D909F0B153265B107445D3052E81D9A4D50A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EST5EDT) {.. {-9223372036854775808 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-84387600 -14400 1 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Egypt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):170
                                                                                                                                                                                                                                                Entropy (8bit):4.862365884559795
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsPHV5XHAIgNGE7TRRL/yCh0DcPHy:SlSWB9vsM3y7fHAIgNTRN/yg0DH
                                                                                                                                                                                                                                                MD5:ACD69F34396296BA553243267D06CEE0
                                                                                                                                                                                                                                                SHA1:9575FFE5E7833B9532F17AC5413EA9DB23F07ECA
                                                                                                                                                                                                                                                SHA-256:936B6484469351DEF8FAFE8EC180862729F5E43BDE4E53E2E9636E221B54C3C2
                                                                                                                                                                                                                                                SHA-512:149D23FF35747127E9A2F4056D09472E8E689970BC795D5411C5BF621D949ADDEBDA68674D375A248A63106ABDFF6C54A8AFE5385C45BE2916CAED0C30F7C4A1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Cairo)]} {.. LoadTimeZoneFile Africa/Cairo..}..set TZData(:Egypt) $TZData(:Africa/Cairo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Eire

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):172
                                                                                                                                                                                                                                                Entropy (8bit):4.901791318009318
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV5QH+o3vXHAIgoq6QHFRRL/yMQs/h8QanQHuv:SlSWB9vsM3ymnQeoPHAIgonQzN/yM/hm
                                                                                                                                                                                                                                                MD5:E9C2C97EB65526F1D4BE1AD7385336FA
                                                                                                                                                                                                                                                SHA1:09E4000CE320F779E2DFCA2FFD6B9258FFBA6CE4
                                                                                                                                                                                                                                                SHA-256:B78A833337EFEC8B5F64622F1BFDA21FCB79CF290E9CF32A54B206EB20C6FDE9
                                                                                                                                                                                                                                                SHA-512:EAEC097B58BF466CC7D6C0C6297628AF910CC308AC822565FD6CDABF96CD4EC57D4CC724FE782B6C1B606DFF9424013F6A890A871339577F7CB68BBB3C425E65
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Dublin)]} {.. LoadTimeZoneFile Europe/Dublin..}..set TZData(:Eire) $TZData(:Europe/Dublin)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):110
                                                                                                                                                                                                                                                Entropy (8bit):4.928744204623185
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDMbNMXGm2OHvDwy:SlSWB9eg/yRQJDm2OHsy
                                                                                                                                                                                                                                                MD5:9C08898081382F52CE681B592B8E2C8D
                                                                                                                                                                                                                                                SHA1:165944424740B1FA9B4B3B8E622198ABD0BDA0F8
                                                                                                                                                                                                                                                SHA-256:66B0DF8888883BFF44B18728B48CDF24AAED0BB745D601F3422C4F2D4063E0AC
                                                                                                                                                                                                                                                SHA-512:86EA639F999169F2FBA2457BE5042463A1938031268CCA71FDD03CCBC6194932937BA58B49FBED461E055E9AA668FF6EBF391AA7EC603C0A425416DF2E6CC84D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT) {.. {-9223372036854775808 0 0 GMT}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+0

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):159
                                                                                                                                                                                                                                                Entropy (8bit):4.910789466104329
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDOm7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRSw8RQy
                                                                                                                                                                                                                                                MD5:333F2BFA92742A49BB88F11C7CD896A9
                                                                                                                                                                                                                                                SHA1:BB5BEC010C36427AEEBDDA2FB72083E22A3F5073
                                                                                                                                                                                                                                                SHA-256:64466EA3759301E88C29AD1A833CDCBBC495EB4A5A3AC45E7B2987FECD6702BD
                                                                                                                                                                                                                                                SHA-512:E2270F4B57C5F1C849726259B886E8644DCF497FA0D034AD48885146BEDC70DC8899900DA9AC01F2609A2DA881E10F9042CCBF75A3F5DA7344D7E92F1B070806
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT+0) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.980500771169276
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOveyXMXGm2OH1VOwVn:SlSWB9eg/yRSvPDm2OH1VOwV
                                                                                                                                                                                                                                                MD5:A7C3FD06D1E06F125813C9687C42067C
                                                                                                                                                                                                                                                SHA1:515622C0B63E977AFBFC78AD8466053C4A4A71A6
                                                                                                                                                                                                                                                SHA-256:3BE1EC71D2CC88FA9A3DB7DC0476475F33FE5BCBE6BC35C0F083859766466C32
                                                                                                                                                                                                                                                SHA-512:548DA608CFCA5B8539652F94CA2040D624602D2DF64B2C8CCDB8B219B9B384E01386CDF95F3BF77409DF0584FA12A3B73D56D13107D98BEB4C2555F458B3F374
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+1) {.. {-9223372036854775808 -3600 0 -01}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+10

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):118
                                                                                                                                                                                                                                                Entropy (8bit):4.965033464829338
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOPFNMXGm2OH1VYU7vV:SlSWB9eg/yRSPXDm2OH1VYW9
                                                                                                                                                                                                                                                MD5:FF71149E56D4CB553D0ED949B5F4C122
                                                                                                                                                                                                                                                SHA1:3459B47E0EEC80D7A29512CA4F3F236C89E86573
                                                                                                                                                                                                                                                SHA-256:E61E826E6FBC2396EF152640698098F4477D4FFDFE5F791F62250C3EC5865304
                                                                                                                                                                                                                                                SHA-512:43B0CC8BD7F1EFC80C3F14F115D651EADD5743B17B854C2FB7AC25995138D3DF8792915C2952B80F35784A7115F8FB335ACE171479B24C668190AC175523DB21
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+10) {.. {-9223372036854775808 -36000 0 -10}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+11

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):118
                                                                                                                                                                                                                                                Entropy (8bit):5.002239901486653
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOeJMXGm2OHaBByVn:SlSWB9eg/yRSsDm2OHa7yV
                                                                                                                                                                                                                                                MD5:08AABA917A8D6B3BB3D0DD1637F5ABFC
                                                                                                                                                                                                                                                SHA1:D1D704F0250D4CBD450922A02D021E0000FBF5CF
                                                                                                                                                                                                                                                SHA-256:143528946275DDC8B894218D3F1BE56C950F740828CEC13166C3D7E8E1B6BB7E
                                                                                                                                                                                                                                                SHA-512:F37AE54864A613C830308CB94AB7CEA9534A86A53B52B4A2C28CEEFE6F5BC0518143AAFD77A6DA5EC55D392F5BD34FCD4B5BE51794B1A386ED783B9BA89C10C3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+11) {.. {-9223372036854775808 -39600 0 -11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+12

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):118
                                                                                                                                                                                                                                                Entropy (8bit):4.97889339723103
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDONdNMXGm2OH3FNyUFFv:SlSWB9eg/yRSNDm2OH3XyMv
                                                                                                                                                                                                                                                MD5:7374B66D6E883D7581E9561C3815EB92
                                                                                                                                                                                                                                                SHA1:235E96A7420DF6733F3CA368D4A2D57766656043
                                                                                                                                                                                                                                                SHA-256:A93EAFAC2C1089C608C8536127D0E8B53D8C7CFD13AE7DD69339E12A89F803C6
                                                                                                                                                                                                                                                SHA-512:9BA59B17F20D65DFF1A5A2D557B535F69B04C172AECB15F88CA3484D74CC7D53894985C08653CF13D868BCBD5E7E5041E0CB2F457B5B603F3851198E552E33A7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+12) {.. {-9223372036854775808 -43200 0 -12}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+2

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.922268982357521
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOcF3vFNMXGm2OHnFQVIyV:SlSWB9eg/yRS0fXDm2OHnFQVb
                                                                                                                                                                                                                                                MD5:FDDC663E40F8FFFE27959E94625725DF
                                                                                                                                                                                                                                                SHA1:EE3FBC1F6C8BBCF1BDC9E5DB4D2EA1A57E2E9BB3
                                                                                                                                                                                                                                                SHA-256:AD5833153446960BDE0653A22AE2111BF80CFD61C3010993CE87B81D40C75C72
                                                                                                                                                                                                                                                SHA-512:A1B2A153834FEAD7DC27C0918E1B1CB905671F82850C1CAAEBD89F5535703FB259F02F699EA7F82F3044E37668EE93DFA4D4EB862CD437AFF0DABA84867B1963
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+2) {.. {-9223372036854775808 -7200 0 -02}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.949132511023475
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOFfMXGm2OHBFVGAvFv:SlSWB9eg/yRSlDm2OHBFAKV
                                                                                                                                                                                                                                                MD5:5C6F16F2CFD46030688066F9BFBE675D
                                                                                                                                                                                                                                                SHA1:1DB5F36584822EB92E75B9AC9F440FD671BD90AE
                                                                                                                                                                                                                                                SHA-256:C7BEE4C71905EDDB40BAF42C0CD0DC70BB9F298EAAB8B9367D484B8431DD084A
                                                                                                                                                                                                                                                SHA-512:FFB2C4CD8EA7DE165C3D989454898FF2023D1A1E3B2B34EC23B1B71EFA7BF2538488DA0069E59F1152B8933D2263B762D2D7C56ADBED826C33FC0BA6672E34DB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+3) {.. {-9223372036854775808 -10800 0 -03}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+4

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.971627677226461
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOqJMXGm2OHBvGQy:SlSWB9eg/yRSQDm2OHBON
                                                                                                                                                                                                                                                MD5:E35244C1A6084C7BC1D79E437677C55C
                                                                                                                                                                                                                                                SHA1:898619DA4B8B9AC72E69C7BD30DEA2ADEF9440FE
                                                                                                                                                                                                                                                SHA-256:26D1EF512CC5797FC63BA2B83C7D6271025F4D4F5C904D9FA8E97F053393D9A7
                                                                                                                                                                                                                                                SHA-512:0687758558C4C5FF7802F3A57212694A1515761A8337D4B75FFE81434D2AD8A221B005DEC36BF013F2FC3DE1E46DFBED36352811EB7C5A5AE3A167A2E314F57C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+4) {.. {-9223372036854775808 -14400 0 -04}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+5

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.956438091983076
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOJNMXGm2OHLVvyV6Aov:SlSWB9eg/yRSDDm2OHLVKVg
                                                                                                                                                                                                                                                MD5:7C560A0F3C42E399AC1247CB6C516DC6
                                                                                                                                                                                                                                                SHA1:C314B09D4E369C69C23A8DC1FB066FD0CFDC7211
                                                                                                                                                                                                                                                SHA-256:054910BDDFC44D9B806BBD3008C30547FA57ECD3C043418C406A725158144688
                                                                                                                                                                                                                                                SHA-512:FCE8431B759BD5359847734FD98D9D91394916235B2AF587FC927D5F3196FB283E241A6A9200EA852F9265ECEF81402FF6ACD0FA3A4AAEF6DF9DB1B056B3A9EF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+5) {.. {-9223372036854775808 -18000 0 -05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+6

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.974743300958087
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOAkSMXGm2OHvTmULyn:SlSWB9eg/yRSbSDm2OHviX
                                                                                                                                                                                                                                                MD5:EEB1A3E0FD3339E332587D19C116D4EF
                                                                                                                                                                                                                                                SHA1:5DBF046031CD354B1EF88E46D3FED74706D21AC6
                                                                                                                                                                                                                                                SHA-256:D53BB247E0E429A6243AB9A9BDCAE1EE1CF5F271D79748A843631906AB63A988
                                                                                                                                                                                                                                                SHA-512:07BDF9056DC335C773684E634B1D389FBD139464D4597DE862B7EAC096676A093934682BF911F4E68F299789931218C0E431F0CC6BEBD7275B5FC8015EDD0942
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+6) {.. {-9223372036854775808 -21600 0 -06}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+7

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.930134062078826
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDONeyFNMXGm2OHrXVYVny:SlSWB9eg/yRSNPDm2OHriVy
                                                                                                                                                                                                                                                MD5:F92B31548D6BF8CCFA326C0CA6E205A0
                                                                                                                                                                                                                                                SHA1:3FFC6C214EDBCBE9C2509306CE73B429113E1C8A
                                                                                                                                                                                                                                                SHA-256:6BA5779E35D581B409F53B14B6E28ECC16F536FFEDD45DDBC8DAE4B8C28F66E7
                                                                                                                                                                                                                                                SHA-512:317872E986099D02AF083397AE936854043D54CEBF45A70672F02DDC9E2F3B27BC3FA80902F9675131C51A09BBD3C2BD1CD437330935CEA113C643769E0DF20C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+7) {.. {-9223372036854775808 -25200 0 -07}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+8

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.915798027862021
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDOOF3vXMXGm2OHmFvGpn:SlSWB9eg/yRSqfXDm2OHaOp
                                                                                                                                                                                                                                                MD5:B31B15E6006F8DF0D7627D6C90FF39AF
                                                                                                                                                                                                                                                SHA1:7C4137BE11DA84771DF6DC5EBC32D5E5E87E060F
                                                                                                                                                                                                                                                SHA-256:CA87559B154B165E83482AEE3D753BA8E38ABCA347A005E8504C566433CF4CB3
                                                                                                                                                                                                                                                SHA-512:220F7E7379EABBC8ACD7ADBB7A4AC8E93E4B268F8F1C0965B7E6A09735EE86E293EF1C492990331EEB4176B8301A91EC20579756B962AE45C858A96C09349CCD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+8) {.. {-9223372036854775808 -28800 0 -08}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT+9

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.95764928386407
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDO3fMXGm2OHNms:SlSWB9eg/yRSPDm2OHNms
                                                                                                                                                                                                                                                MD5:5B10173EB7119F1219250763504A3526
                                                                                                                                                                                                                                                SHA1:A845021437C4638079040EF27AEF163C865FF8F8
                                                                                                                                                                                                                                                SHA-256:A0987A1D078B0993FB3B07208E3F4538A2319DCDDDEB2FAEA32FC463DEAFB8DB
                                                                                                                                                                                                                                                SHA-512:D213285D0A723B7771263122AFA269C2ABD0325A97D32C3870341255C06597DD6851C22860CFF42BF54E3FF5A36FC88C306F3BF1C69E7BD7FD7F69FE7601ED1A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+9) {.. {-9223372036854775808 -32400 0 -09}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-0

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):159
                                                                                                                                                                                                                                                Entropy (8bit):4.898210849752128
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDIyHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRUyJ8RQy
                                                                                                                                                                                                                                                MD5:5AFB7F12BA056619252D48904523DFA9
                                                                                                                                                                                                                                                SHA1:CD6E6681C8302BF38095975DF556BD14959FDAC8
                                                                                                                                                                                                                                                SHA-256:EFF27B3DEE9306641FF344801E06BB33FF768CDCCFE2409FA8AF752FF6D39F66
                                                                                                                                                                                                                                                SHA-512:2869BB347F42667A3D174816466B15916FC61FCB5A6A1BE1DD750C5C1751602FEE0FE5A27651B7A19C9F6764872DD0F00D3D5AA16CA1A743DBA09646D25A4EB2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT-0) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):115
                                                                                                                                                                                                                                                Entropy (8bit):4.979902281541545
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDI/fMXGm2OHMKUrn:SlSWB9eg/yRUXDm2OHtUr
                                                                                                                                                                                                                                                MD5:4000096844091488200125FC8F50E2F5
                                                                                                                                                                                                                                                SHA1:9FFEAE66405CFB254180C7DBE185288791DFEE5F
                                                                                                                                                                                                                                                SHA-256:B4BF883FBE9246EF4079179A746B1F9E59F2C77D4F598794B60732D198DC6044
                                                                                                                                                                                                                                                SHA-512:25C69E04018C2978A2E5748F0D3C61157453D998C16FA4B3C257A6515B87F5FD2B754893B47604BBC60AB60B60BA162BF2D1463E616E72CB8713C736F1B4D428
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-1) {.. {-9223372036854775808 3600 0 +01}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-10

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.964101313797091
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDINFeyFNMXGm2OHMUUMy:SlSWB9eg/yRUN5XDm2OHXFy
                                                                                                                                                                                                                                                MD5:AE6601FACF6BE1E68083F8D353901181
                                                                                                                                                                                                                                                SHA1:8B3BFA307D2A94BADD3A1A5E42545D6F7C620BCE
                                                                                                                                                                                                                                                SHA-256:EF3046D7789CAE069B5473D053F3EF0157248F8A359A1282EE02BA613A75FC94
                                                                                                                                                                                                                                                SHA-512:1859E6A2CB94EFEE7CD5C17803AA4F2DEEBE4DCF43D3B1EA737DF00BA86ECEC79D296D75E69D5829DECB48380B6B650724104FFA7959FD18FE032DF7D002A88B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-10) {.. {-9223372036854775808 36000 0 +10}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-11

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):5.00162575418652
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIVSMXGm2OHlVVtyn:SlSWB9eg/yRUVSDm2OHlVLy
                                                                                                                                                                                                                                                MD5:D864BA451C9E441BF47D233626C57B99
                                                                                                                                                                                                                                                SHA1:6C38E6F8BA292575C496124572D187F97C9F8E73
                                                                                                                                                                                                                                                SHA-256:CCDEADBD18BE81E59A669A460A14AFCBFF733C3A5D164FC2B6B93DEAF009B78A
                                                                                                                                                                                                                                                SHA-512:5C16BD1189F3FE6789CB3630C841FD168EC87D0498EE6FCC4C8D635F8CF4BCAF0558B44F859C37E418F6BC5A7F6693D6EF1DD218A1DB6DA2D54FF55916685119
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-11) {.. {-9223372036854775808 39600 0 +11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-12

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.978079707159482
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIjbNMXGm2OHwvv0UIoAov:SlSWB9eg/yRUjJDm2OHwvv0YAov
                                                                                                                                                                                                                                                MD5:C3E7748C7CB9D8A7F7FA5170D5098983
                                                                                                                                                                                                                                                SHA1:54F5374A32173BEC6EDA430745DCD18749ABC233
                                                                                                                                                                                                                                                SHA-256:23B61B18C653E25F7245B0BB6E04AD347E038585B145962FD1EEACE26F118D54
                                                                                                                                                                                                                                                SHA-512:4783A7CD4C94CCC67C1C71F9C5D9CD99A3918EA4792D8CE2443ACE8F034B9023EBC02405B5DEAB919AA35FD1FD29D8980774316AC96D32ECDEBEFA15BBE6878D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-12) {.. {-9223372036854775808 43200 0 +12}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-13

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.994320173226919
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIaMXGm2OH1dNv7Dy:SlSWB9eg/yRUaDm2OHty
                                                                                                                                                                                                                                                MD5:224AAAA8A31C283F50149A090E3970D5
                                                                                                                                                                                                                                                SHA1:E7E4876EC2474FEFD82D4B174CA8E3A3427062F5
                                                                                                                                                                                                                                                SHA-256:A9F1AD5A7CB5ED43C5E6E8A7A9B887329890ABB75B9FC9483B8543A367457EBE
                                                                                                                                                                                                                                                SHA-512:6EE0C6F519AAB2DAA3F7D802F0F838BA9F6BF1D56530000D3C9EA4FDA81DCB9832A3285E36208F29EEB23C27EC5BFD3438DC272929A7531268B7C0626A65D6A5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-13) {.. {-9223372036854775808 46800 0 +13}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-14

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):117
                                                                                                                                                                                                                                                Entropy (8bit):4.9895752453470585
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIxhfMXGm2OH0FVtXvFv:SlSWB9eg/yRUxJDm2OH8jNv
                                                                                                                                                                                                                                                MD5:8ADF71739DCADE63433B7BF8321EAC77
                                                                                                                                                                                                                                                SHA1:AA6BDE83FF0D8BCFDE0426160250F2D17D3AF81D
                                                                                                                                                                                                                                                SHA-256:A37A7160027BD38356764C4D1AA5B9B17F8D5DC3CFB81EF2ED399E44C41734CE
                                                                                                                                                                                                                                                SHA-512:AEE3929DE269ADB5265A54841F041E41595359C101539F6309A4E737E3F5DF0BC91560781C7118975398C29A084113682C78F66E07E2E4AC5EAC8DFC33C4F0ED
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-14) {.. {-9223372036854775808 50400 0 +14}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-2

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):115
                                                                                                                                                                                                                                                Entropy (8bit):4.921164129348819
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDInWNMXGm2OH/VXF9:SlSWB9eg/yRUnSDm2OH/Vb
                                                                                                                                                                                                                                                MD5:CABB864F4E76B90928F5C54CD9334DEB
                                                                                                                                                                                                                                                SHA1:4818D47F83F16B9F7612D1E979B2440C170ECDB9
                                                                                                                                                                                                                                                SHA-256:7211BF8329B2388563ED8FA8C5140099A171B8A303A9473E9A6F3AF0C5D239CB
                                                                                                                                                                                                                                                SHA-512:1FDCB05D675F1D28CB52B9F5EAC7EC52FDF2CE7E7411740A6F8FB5E9D443ED636CE268E3AF9E08605CC3E13A49B2D86FF4EA6A85F518D5C79E263BA94263361D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-2) {.. {-9223372036854775808 7200 0 +02}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.948161547682094
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIYyXMXGm2OHkNsWYcv:SlSWB9eg/yRUlDm2OHkKWYe
                                                                                                                                                                                                                                                MD5:4AE5F29A13A86E4A7064E9200668E43B
                                                                                                                                                                                                                                                SHA1:2460BD1BB0FF3A3C774A5C7CC3DA10235DA06B0D
                                                                                                                                                                                                                                                SHA-256:BFC86D65B0B94725DCE4C88EDC4300141ABBCA4B6CDECF037C437DF49F0C1D6A
                                                                                                                                                                                                                                                SHA-512:190DC38B4A20F964C967866507086317D85D979DFCFA415D1569C485C6476024922BC6E7103273C41889D9D7B22E97933F286FCF4D341248077C1BA777D0EE3B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-3) {.. {-9223372036854775808 10800 0 +03}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-4

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.970850637731657
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIQXMXGm2OHkVsRYovV:SlSWB9eg/yRUQXDm2OHkSN
                                                                                                                                                                                                                                                MD5:BBAF760E27C02D176A675AC3CF2D1E6D
                                                                                                                                                                                                                                                SHA1:E524FAA7D424A1C1545D1D8EC00169125A68E8E5
                                                                                                                                                                                                                                                SHA-256:02E2EEAF88EE179EF63DD29ACC7384A4B46DE1E3A151C1F3A5DD31BBB5A05AEE
                                                                                                                                                                                                                                                SHA-512:6AC7CC0E52E7793C7F2D3DDA9551709DEAE654C1182EAD7108D04F1BAAAB7E1C473B6E8A3A126B0E421D8A246294A03B2EE9E070330924502DF2869CC61C37F7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-4) {.. {-9223372036854775808 14400 0 +04}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-5

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.955530107787899
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDI7tNMXGm2OHM0VQVFv:SlSWB9eg/yRU7PDm2OHnVQVV
                                                                                                                                                                                                                                                MD5:17F64A5969D3755211E60C0A9F83974F
                                                                                                                                                                                                                                                SHA1:FEFA84725EFAE6405F43797296C342B974F2D272
                                                                                                                                                                                                                                                SHA-256:3A2C75DCA11D1167126F0D44A8682420FAF75B0B82B3DCFC35A9F028A9A759E8
                                                                                                                                                                                                                                                SHA-512:77DBCD8284A470E4869976E2E8A5EDE28104283F120C863785A6B2E64CF87E06243196817C0055A9B32D6FFFE94A25772F67D58BF8E885F7EC06C34FABE38766
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-5) {.. {-9223372036854775808 18000 0 +05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-6

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.973993120288556
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIg3fMXGm2OHETNSTVVn:SlSWB9eg/yRUgPDm2OHETMX
                                                                                                                                                                                                                                                MD5:51CAF7956E133C8A9788AE0B8C6145AB
                                                                                                                                                                                                                                                SHA1:47F8B49DF9ED477BD95F908693A483AE4FDE881F
                                                                                                                                                                                                                                                SHA-256:D22C87321373EC0EFB0F312925476CD0747323EF303E17621A871BF814C8ABB1
                                                                                                                                                                                                                                                SHA-512:EC4B4BE74C1BA64DEC8EF11DAAA338C52BD67D55E8A2352FBC6C83FA142F8DBE424CC1110E9A9D9A891E1E858D1FFA6D1E3B997D41BBB374556FA1F9A708559E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-6) {.. {-9223372036854775808 21600 0 +06}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-7

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.928999319005163
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIpdNMXGm2OHAXUVSYovV:SlSWB9eg/yRURDm2OHAXUVSYyV
                                                                                                                                                                                                                                                MD5:56D88B54CA33B43E2E7D3EA6AD3A4D6E
                                                                                                                                                                                                                                                SHA1:9351E0C001C5D83325281AF54363D76D65548B7D
                                                                                                                                                                                                                                                SHA-256:70CB3A766A2E84148B68613D68687D263D3592ED4B6E672797FB20801ECA8231
                                                                                                                                                                                                                                                SHA-512:32B58AD16F64590903C7AB49BA4890DAF6F1F3D33187A7654D3DA88A1C0047483EAA58B2498D824A30116E235FCC8F8FB3FADD57F86396240E5D92B2CA337027
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-7) {.. {-9223372036854775808 25200 0 +07}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-8

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.9145396982864895
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIlSMXGm2OHN/VsdYLyn:SlSWB9eg/yRUlSDm2OHUp
                                                                                                                                                                                                                                                MD5:E462AD5E0C046EA6769EDB4B2C80F4D4
                                                                                                                                                                                                                                                SHA1:6DDB94485648622875E0927BA1E8CFE67CEC1382
                                                                                                                                                                                                                                                SHA-256:80C85D59416CEC91DB3DAC5FDD2FD7B91D6FC74A37BBBEF6FF58F6F6816E8FC9
                                                                                                                                                                                                                                                SHA-512:42734FD2DA8BD6E0BC271FF1375A31DEB72EED85AB5EA6E1E0F81EE4E3E7E74380FFC98FAC30409684F736DB580AAAF4F62DB4757AA35C10383584F6144EF363
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-8) {.. {-9223372036854775808 28800 0 +08}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT-9

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                                Entropy (8bit):4.956751740978211
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRDIeyXMXGm2OHENScFAy:SlSWB9eg/yRUPDm2OHsScr
                                                                                                                                                                                                                                                MD5:98F70EC1B1AC7D38CB8D01705FB0CA56
                                                                                                                                                                                                                                                SHA1:EDAFA132E48935ACEB8E72D3FF463E4FC857C1A9
                                                                                                                                                                                                                                                SHA-256:57395BB968AFA5A041EADA4B684B82F0379A9333F9522D69F069A79FDEA2B8D7
                                                                                                                                                                                                                                                SHA-512:97B8D7603D6B54C075B005B905B2A7A28B8BEA67894F055663C44D2BF730BB937AC8EF5B2DF182BDD2D9EFFDBD135DF9467C813AEE39AA6B34256908A12DC011
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-9) {.. {-9223372036854775808 32400 0 +09}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\GMT0

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):158
                                                                                                                                                                                                                                                Entropy (8bit):4.886484135647838
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDVMFHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRC1p8RQy
                                                                                                                                                                                                                                                MD5:F879FB24EA976394B8F4FAF1A9BF268C
                                                                                                                                                                                                                                                SHA1:903714237EBD395A27EAF00B3DAAA89131267EE5
                                                                                                                                                                                                                                                SHA-256:AB742F93BE44BD68AB8FE84505FA28120F1808765D9BAED32A3490AF7C83D35B
                                                                                                                                                                                                                                                SHA-512:F5EE4C331E37036516F2A1BF12F2E088B2E2C7F6475127BF4E7B4937F864550D64D570BC855B6058D4311755E8696EC42095A36AEF13BB29E62192EE0AFB6EAF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT0) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\Greenwich

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):163
                                                                                                                                                                                                                                                Entropy (8bit):4.911342539638601
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRp+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRp6BURQy
                                                                                                                                                                                                                                                MD5:CDD2DE9CF0FECFEA0CDD32DAC32DCDE2
                                                                                                                                                                                                                                                SHA1:311CD4C6E819E18BAAACC382F81359BC208E2F73
                                                                                                                                                                                                                                                SHA-256:F89167B6117838D9679C0397496B6D96D3A7BEAEF0BD99406ABACDBDB658FBCC
                                                                                                                                                                                                                                                SHA-512:1AF061D07D2F579A089905B6B259AABD7C58F4FA0CD379EE54206164F0DCAEA5C720FB1F5E76F5782F8613E62D8F83BD55F1848D5D7A73D4A5C9F7BC6B9F5DB1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/Greenwich) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\UCT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):157
                                                                                                                                                                                                                                                Entropy (8bit):4.838936002050477
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRKh8RFB:SlSWB9vsM3yzTHAIgm6N/yR68RX
                                                                                                                                                                                                                                                MD5:0587EB7D1B1C684A4A0F90D3CB0959C8
                                                                                                                                                                                                                                                SHA1:3F2840AE512774494D9A0B6357C52CCB7DBA5265
                                                                                                                                                                                                                                                SHA-256:0856D14DBBC53D46460BCD530BD070E9E8966D1C96BA01BA556E215A98C09CD4
                                                                                                                                                                                                                                                SHA-512:DE38EF28893853219AC24AE4A522307ADAA1502F6D0C129219FAD9D75CFCE03A505C3E0758CFF2D2D4F7101414A5F7E4FC1C1B119B667E6A9C89B60DDA641E86
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/UCT) $TZData(:Etc/UTC)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\UTC

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):110
                                                                                                                                                                                                                                                Entropy (8bit):4.903699772785336
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/yRF3yFNMXGm2OHvL:SlSWB9eg/yR9SDm2OHj
                                                                                                                                                                                                                                                MD5:3D3F94B6AC5FA232E509356C703D9177
                                                                                                                                                                                                                                                SHA1:502B8EE9D4A1EA75A91272181AC87B9B6ECE1F84
                                                                                                                                                                                                                                                SHA-256:4D74D9EC2397B1708FEF47806294B0BCA26679F3A63149AE24E4E0C641976970
                                                                                                                                                                                                                                                SHA-512:205A761A01C577F602236CB5C9938C834B7F3F9F681B94036B0A86101119893EF87D206D0C3F7737075ED833D4E35E374ACAE6605163E9C37B705D99BEBC928C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/UTC) {.. {-9223372036854775808 0 0 UTC}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\Universal

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):163
                                                                                                                                                                                                                                                Entropy (8bit):4.874807282103623
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRYzXDJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/yRY7VMr8RX
                                                                                                                                                                                                                                                MD5:65E28EFF342B625E79175793FD38F9FD
                                                                                                                                                                                                                                                SHA1:08B11474822E670DEAB8F0EA168BAED7D5E3DBE1
                                                                                                                                                                                                                                                SHA-256:A2B62C5914DE169A68A018A5B47C1253DBCA10A251862D17B0781ECFD19B6192
                                                                                                                                                                                                                                                SHA-512:79641D0E05F81BFB80034937D34E74B7483A790F33C1F9A0FA92C6A7913AC8C03036CFDEFB43850B84EFB3DD3C4A39022DC8F22E5B5DE6353586A546E03A5789
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Universal) $TZData(:Etc/UTC)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Etc\Zulu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):158
                                                                                                                                                                                                                                                Entropy (8bit):4.874356623237119
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRaQEBURFB:SlSWB9vsM3yzTHAIgm6N/yRYaRX
                                                                                                                                                                                                                                                MD5:EDABCAC858EC9632D5D8DCCFB28F4D6E
                                                                                                                                                                                                                                                SHA1:E5BEF1367A97A1900749CE6B1E01CF32F582BDD9
                                                                                                                                                                                                                                                SHA-256:BBD6E93206FF3B7017AFBE63905B4C932C422B582F3CE2A79A7B885D390EE555
                                                                                                                                                                                                                                                SHA-512:3A22364D423F2F970123561408018A2B72F43C4978836D3B6DF7517217445605838DCB8DDBDA204FD01C49A4A7D5ADAD4CA8BDA7C3B412D54750BAEAA589B683
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Zulu) $TZData(:Etc/UTC)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Amsterdam

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.892809684252761
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/So3vXHAIgoq82yHRL/yQaiFAXowQahCv:SlSWB9vsM3ymhS2HAIgoh26N/ywAXoww
                                                                                                                                                                                                                                                MD5:B0B409D665190569A56697799FBA5CD3
                                                                                                                                                                                                                                                SHA1:840AA7D61E64ACE61FDDAB96F716575A61CEDB52
                                                                                                                                                                                                                                                SHA-256:46141E7BC0F99D2117319C661569F8B38AF7D00108CED5784FA3A3B5090EF8E9
                                                                                                                                                                                                                                                SHA-512:D7C0588D98AC46B5191D7C7E8F5181E94306EFFCC9E3F2DBA9E0003BAE51D992334527ADDD6D0C9701CFD60169A74984B3401E7A6A1322A734BC3D90DCC933BC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Brussels)]} {.. LoadTimeZoneFile Europe/Brussels..}..set TZData(:Europe/Amsterdam) $TZData(:Europe/Brussels)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Andorra

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6927
                                                                                                                                                                                                                                                Entropy (8bit):3.8182041031531897
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:CA34elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:CI41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:D897DCA686A03495EB2C3323FAB0BEAD
                                                                                                                                                                                                                                                SHA1:1433BC303DE92F7B36F881C8595A42B35E0814FC
                                                                                                                                                                                                                                                SHA-256:F0B48DA7CA3659450D87CC0DDFDDFD28B464543DF1EE40D935C44D5CD7C9B9B3
                                                                                                                                                                                                                                                SHA-512:A1C4AE1E0EC26B159B0F5D058A7A77B8774F611A4D3C6AECEDD7186957D6BD9F15CDFCBA248FCC8A4B4146BD72CD7D66B9F88A2BF7CDEF416F1831A2F335D48C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Andorra) {.. {-9223372036854775808 364 0 LMT}.. {-2177453164 0 0 WET}.. {-733881600 3600 0 CET}.. {481078800 7200 0 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0 CET}.. {733280400 7200 1 CEST}.. {749005200 3600 0 CET}.. {764730000 7200 1 CEST}.. {780454800 3600 0 CET}.. {796179600 7200 1 CEST}.. {811904400 3600 0 CET}.. {828234000 7200 1 CEST}.. {846378000 3600 0 CET}.. {859683600 7200 1 CEST}.. {877827600 3600 0 CET}.. {891133200 7200 1 CEST}.. {909277200 3600 0 CET}.. {922582800 7200 1 CEST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Astrakhan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2063
                                                                                                                                                                                                                                                Entropy (8bit):3.679377249443024
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:TvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDOP:rCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
                                                                                                                                                                                                                                                MD5:CB860328FA96A14055BF51A3B2D35A08
                                                                                                                                                                                                                                                SHA1:CFA49DC861F4AC3D29A78D63D71C2D6D83D68F84
                                                                                                                                                                                                                                                SHA-256:4B5FB0AF225974D117374028285F20A02B833FF4136E6BFAE7B65E6D6D28829E
                                                                                                                                                                                                                                                SHA-512:960152826F4245012462E53F80B69B0C45C27D75D46C70D485674CA19071DF268671C7691B614BE53B9E7BD8CFEC5D24F3DCF933F2F14D827F2A32EB347D7540
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Astrakhan) {.. {-9223372036854775808 11532 0 LMT}.. {-1441249932 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {7

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Athens

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7954
                                                                                                                                                                                                                                                Entropy (8bit):3.7252594544513795
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:1D/8QdzFu+f+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:Z/8ohvyDjivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:8B2C99E1CD04D7559709FDF8D382343C
                                                                                                                                                                                                                                                SHA1:C595D5159C742B815AF89EC8604376E01291F9F1
                                                                                                                                                                                                                                                SHA-256:47353319419505AAB205C23F8C97EA0B12E5DED2113147794F77B67349AFF52F
                                                                                                                                                                                                                                                SHA-512:227CA21A3B6160357988582E261A62AE7B09D46D479EABFAC8039185D710EFA765CD1694F4388EBF8800978A1E1DB69F6AF9BB9BF82C0FCD66E883930E1F8249
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Athens) {.. {-9223372036854775808 5692 0 LMT}.. {-2344642492 5692 0 AMT}.. {-1686101632 7200 0 EET}.. {-1182996000 10800 1 EEST}.. {-1178161200 7200 0 EET}.. {-906861600 10800 1 EEST}.. {-904878000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844477200 7200 1 CEST}.. {-828237600 3600 0 CET}.. {-812422800 7200 0 EET}.. {-552362400 10800 1 EEST}.. {-541652400 7200 0 EET}.. {166485600 10800 1 EEST}.. {186184800 7200 0 EET}.. {198028800 10800 1 EEST}.. {213753600 7200 0 EET}.. {228873600 10800 1 EEST}.. {244080000 7200 0 EET}.. {260323200 10800 1 EEST}.. {275446800 7200 0 EET}.. {291798000 10800 1 EEST}.. {307407600 7200 0 EET}.. {323388000 10800 1 EEST}.. {338936400 7200 0 EET}.. {347148000 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Belfast

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.876296755647751
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQahs3QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/y72
                                                                                                                                                                                                                                                MD5:7160C6EE32380846653F016AE8AFD52A
                                                                                                                                                                                                                                                SHA1:DE7805089639C54893F2107FA67342DA72A79BBC
                                                                                                                                                                                                                                                SHA-256:557023674F6E8376707517103EE69C1DEBBE53CDD4BCAB11E763CC53B9CB1908
                                                                                                                                                                                                                                                SHA-512:FDBDECBBDB0C419226E2604608FD2923CFB06E4B6948493208FD83FD796880E81F6147C0FAFEB572079C9C916831B7B055620EC939164CCA1DAF76897BE60F2C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Belfast) $TZData(:Europe/London)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Belgrade

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7309
                                                                                                                                                                                                                                                Entropy (8bit):3.8204712502914653
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:lp+/4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:lY41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:02A003411B61A311896A6407B622152A
                                                                                                                                                                                                                                                SHA1:3B8BC6D1AF698CE7BB14A08307F5A4295EB8ED03
                                                                                                                                                                                                                                                SHA-256:74B225511B518B0CED972CBB33D694697712CCB96A6D81E0F50ADA28CF6E2C92
                                                                                                                                                                                                                                                SHA-512:9E03B3EB1E528E5B1ADBA09F808E73BF9C4314EDCBF6F96E46844D51A5F425BED3EE8FD5BA8706C46A7FB9882485F119F81996F2EAB7E1E9B598978C402DDE0F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Belgrade) {.. {-9223372036854775808 4920 0 LMT}.. {-2713915320 3600 0 CET}.. {-905824800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-777942000 7200 1 CEST}.. {-766623600 3600 0 CET}.. {407199600 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 360

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Berlin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8020
                                                                                                                                                                                                                                                Entropy (8bit):3.820756136386754
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:Pi9+qFR274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:PQs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:84027C3C8315BD479B38DE11F38E873F
                                                                                                                                                                                                                                                SHA1:6E92A2A9734A9C6B02ECCD99F114D667C909C5BA
                                                                                                                                                                                                                                                SHA-256:7E7111F06288069B52A4E1CA0B016216DF9328FB3B1560A740146497CCDD4D24
                                                                                                                                                                                                                                                SHA-512:5FFDE523021FC0C490261F55999204C9CE6C8C274888525EA6EE7C01BC5CCABC7A3877FD454B4167D81F4B89BACB087E8BA6AB0BAC46C2874ED9257BE2092340
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Berlin) {.. {-9223372036854775808 3208 0 LMT}.. {-2422054408 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-776559600 10800 0 CEMT}.. {-765936000 7200 1 CEST}.. {-761180400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717631200 7200 1 CEST}.. {-714610800 10800 1 CEMT}.. {-710380800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Bratislava

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.943205109348136
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVtXrAeovXHAIgoquXrsY6RL/yQahcvEB5yQazXrH:SlSWB9vsM3ymzbAeSHAIgozbsY6N/y7c
                                                                                                                                                                                                                                                MD5:C69AB60BE74D4BB7E31BE4E5ECCD8FD2
                                                                                                                                                                                                                                                SHA1:9DD0BA6171080F074858EF88ADA2E91C1F465619
                                                                                                                                                                                                                                                SHA-256:1D7C539AAA1E3AD5EF3574A629523B5B781F1A91D352C9B39B8DE7316756026E
                                                                                                                                                                                                                                                SHA-512:C273B97CCFB5F328EB7A13CCA3126DE8D91B3876CBD248990C0BE063DDBE5B0F31EA138E31A1C5C43B1ABCF42EA511448E6DC589EB99E8172D7C2A68BA31A8E7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Prague)]} {.. LoadTimeZoneFile Europe/Prague..}..set TZData(:Europe/Bratislava) $TZData(:Europe/Prague)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Brussels

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9223
                                                                                                                                                                                                                                                Entropy (8bit):3.8450929464870804
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:RhcSQnG1Czyc1+FdDKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcM:Rh8zyc4Ss41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:E6C1153C3F71C8C005D7A46DDF6461FB
                                                                                                                                                                                                                                                SHA1:CBDF7D5D36AF57D83859C910B493464617EC9571
                                                                                                                                                                                                                                                SHA-256:1402A2072ADC9EBB35F4C0368D2E9A7A11493626C667C022614FFB7CC05B6CB6
                                                                                                                                                                                                                                                SHA-512:8B1B47678F75DBE59DB08E034F0701BD11FF4FD3AD0304C8ABF45E848F717D2787B8E47558D3C334D369E0938C633DC217178D3EAE6486CEFBE25CF1668479F6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Brussels) {.. {-9223372036854775808 1050 0 LMT}.. {-2840141850 1050 0 BMT}.. {-2450995200 0 0 WET}.. {-1740355200 3600 0 CET}.. {-1693702800 7200 0 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1613826000 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585530000 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301263200 0 0 WET}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Bucharest

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7974
                                                                                                                                                                                                                                                Entropy (8bit):3.7264631277913853
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:vMSsQMAz5CXNU5paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:vMS1kdUoivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:88DB5686937D3499A8142413B2CF2EB5
                                                                                                                                                                                                                                                SHA1:E37BAD2127553600D0E38A43053D1B07B2498DA8
                                                                                                                                                                                                                                                SHA-256:C560D45104A8DD73FC7370B5AC1615E22043DBC93DFB46A9ECC6468C2D38B19A
                                                                                                                                                                                                                                                SHA-512:375B8A63CFF2E278CD8C78BF9DBC86288FFB1AD57DAED00CD2199F0B05F4FBFA7D17D93C6458B20B86F6D05F3E3A49D594E60AC97DDB47141E21D7CDE10F8456
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Bucharest) {.. {-9223372036854775808 6264 0 LMT}.. {-2469404664 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {296604000 10800 1 EEST}.. {307486800 7200 0 EET}.. {323816400 10800 1 EEST}.. {338940000 7200 0 EET}.. {354672000 10800 0 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Budapest

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8287
                                                                                                                                                                                                                                                Entropy (8bit):3.8244305880244567
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:rHw0+D5xp4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:rQXj41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:11468F958796F971ADD5FB1A0C426D78
                                                                                                                                                                                                                                                SHA1:3FA58BEF391BCF7BAC6A124D093B6505B4EAC452
                                                                                                                                                                                                                                                SHA-256:B58F3E9066B8B57EB037D509636AA67A06ACC8348BE6C48482D87CDC49844A4E
                                                                                                                                                                                                                                                SHA-512:0492EABD6EE16392C00A196AF38995E5F9E55E30A82A50EFFB381DC978E9E63E801555CDC219869E6251BD51115972F742D8A7D9524372B8B11702AE4B28BFB7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Budapest) {.. {-9223372036854775808 4580 0 LMT}.. {-2498260580 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1640998800 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1600470000 7200 1 CEST}.. {-1587250800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555196400 3600 0 CET}.. {-906775200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-778471200 7200 1 CEST}.. {-762656400 3600 0 CET}.. {-749689200 7200 1 CEST}.. {-733276800 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-686185200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-492656400 7

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Busingen

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.952483060656419
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQahDZALMFB5h8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/y7D17/f
                                                                                                                                                                                                                                                MD5:CED145F8D9B231234E021D2214C1064B
                                                                                                                                                                                                                                                SHA1:7B111DC24CA01C78A382CECD3247CF495D71CD34
                                                                                                                                                                                                                                                SHA-256:F511A80AB70FF93A0EB9F29293F73DF952B773BB33EB85D581E4FB1FE06E4F05
                                                                                                                                                                                                                                                SHA-512:E2323C04BF99909ABA9A09A66F9B4696519B5F9FE3AF178FB04D5E0053F41CAA8B937DC4148954ED093D317F454E0547786BEC934F2ABF22A60AAA6A24E63BF9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Busingen) $TZData(:Europe/Zurich)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Chisinau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8096
                                                                                                                                                                                                                                                Entropy (8bit):3.7635458172251406
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:jXSsijEpkv2XkN8qc/OyEie8hF5WQ9VX/Zs1cw27oXqdCA5XqjqFLigTE9s5VpJ:jXS+WeUqKie8hF5f9PwdXM9
                                                                                                                                                                                                                                                MD5:E7F52393523729CA3916768B3F3B4E55
                                                                                                                                                                                                                                                SHA1:1524A3E610DCD33AC0006946BAB2929CA7F5A33F
                                                                                                                                                                                                                                                SHA-256:2BD1C0AB412A5E9C97F533C4D06B773D045215B92568A4E89ADC93C7462D62EC
                                                                                                                                                                                                                                                SHA-512:218674ECD9FD6C1A1C83EE69AFE6AA5AD0D5A8BB59FF497FDF2573B7CF52DAE98ECE0815CF99668CA4E172FF67D220B227369865076333B3EE802A8839C65279
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Chisinau) {.. {-9223372036854775808 6920 0 LMT}.. {-2840147720 6900 0 CMT}.. {-1637114100 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {-927165600 10800 1 EEST}.. {-898138800 7200 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-800154000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Copenhagen

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.925156646979837
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/y+YF3vXHAIgoq8yFRRL/yQagKVihh8Qahyuv:SlSWB9vsM3ymhVoPHAIgoh6N/yy87Fv
                                                                                                                                                                                                                                                MD5:3AEDE4B340D0250D496C49CADBA04E62
                                                                                                                                                                                                                                                SHA1:C466D8275C465752F5B024615268F6D1CBBA4B41
                                                                                                                                                                                                                                                SHA-256:2B9A0F1775355E311FB63903E3829F98B5F6C73C08F1BECE1A2D471ACC2673E3
                                                                                                                                                                                                                                                SHA-512:2B08B57D58699C65A9AAA43AC87F29DD1EDCBA9F91E79DF4B1E07832032F5B03A43847E20345484730E8D2323199E7439D8C1FC662E812E8BA6EE19C53C89681
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Berlin)]} {.. LoadTimeZoneFile Europe/Berlin..}..set TZData(:Europe/Copenhagen) $TZData(:Europe/Berlin)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Dublin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9810
                                                                                                                                                                                                                                                Entropy (8bit):3.7678769652077873
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:sExxHZiMU8EKTy74jT56XdEN1+UZBdMN186LPR:sEzZiMUZ6y0jT5bZHMN186LPR
                                                                                                                                                                                                                                                MD5:E1EB426EA3351AF0D7D563006F9146BC
                                                                                                                                                                                                                                                SHA1:1E94F3B38366FE43BB031A57D19894B569EBABED
                                                                                                                                                                                                                                                SHA-256:895957521D6CA4DE7E4089DC587A6C177B803D8ADF63303B1F85DEB279726324
                                                                                                                                                                                                                                                SHA-512:8F24E9519F5D42F34AEE5C52A94CAC7D035EAE7B31DC3E629C29CFE3BD85F1510188290D35CD327492A030168443FED8BD80EC57ED27811B786C4DC89B4B1181
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Dublin) {.. {-9223372036854775808 -1521 0 LMT}.. {-2821649679 -1521 0 DMT}.. {-1691962479 2079 1 IST}.. {-1680471279 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1517011200 0 0 IST}.. {-1507500000 3600 1 IST}.. {-1490565600 0 0 IST}.. {-1473631200 3600 1 IST}.. {-1460930400 0 0 IST}.. {-1442786400 3600 1 IST}.. {-1428876000 0 0 IST}.. {-1410732000 3600 1 IST}.. {-1396216800 0 0 IST}.. {-1379282400 3600 1 IST}.. {-1364767200 0 0 IST}.. {-1348437600 3600 1 IST}.. {-1333317600 0 0 IST}.. {-1315778400 3600 1 IST}.. {-1301263200 0 0 IST}.. {-1284328800 3600 1 IST}.. {-1269813600 0 0 IST}.. {-1253484000 3600 1 IST

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Gibraltar

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9509
                                                                                                                                                                                                                                                Entropy (8bit):3.8837074152297704
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:QTOKVA1oCobz0W4x2+ZE74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNA:QyoCvTZ641sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:D04F8EDDA1C3611692FB91E317CCADFE
                                                                                                                                                                                                                                                SHA1:1C483FC95459EC6F1D5FE4DD275879A9EBCA1718
                                                                                                                                                                                                                                                SHA-256:0524A31131405347C1D5D86C5EE38A2064AB055C030AB3B43F25DB3B28FFD8D2
                                                                                                                                                                                                                                                SHA-512:4E2E18EBDE2765F2251B1FE41EF8E6AC79875617348974A28619F5E59EC0467239C682CCE8DEBD7A698BE2F00252C77D1F7FA50B6CAFF920B3BE53A0B836F815
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Gibraltar) {.. {-9223372036854775808 -1284 0 LMT}.. {-2821649916 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Guernsey

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.879252060643389
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQakQAL/yQavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yYU
                                                                                                                                                                                                                                                MD5:07AF23DA01CB963EA9E57534E34E7704
                                                                                                                                                                                                                                                SHA1:1C4A214FF3B722E80C0ECACA0FFD5DFF302F6AE9
                                                                                                                                                                                                                                                SHA-256:F7046808A8E80B7AE449D1A49AE3E480096736B7D3F554A240C7DFB10F82076A
                                                                                                                                                                                                                                                SHA-512:713860D340C0EBA5EEF873ECB9B28CCDE9BFAD31B6A8626EF507E96585F5CC1091BF8D8A2DB7E5CB532E44F4561FBAE1797141724EF934755B69919FEA09A78A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Guernsey) $TZData(:Europe/London)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Helsinki

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7368
                                                                                                                                                                                                                                                Entropy (8bit):3.7258352536809705
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:OsR0uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hzj:OkyDjivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:7FF902B06FA79F14553670A70E77FF8C
                                                                                                                                                                                                                                                SHA1:0105051541F38956EA6192BD0C7ED4047668005E
                                                                                                                                                                                                                                                SHA-256:5B5C0A9261A414EA8DC34F594EE05BEE16F695488B230857D2B569A6B603BC39
                                                                                                                                                                                                                                                SHA-512:551940199783A0FF9D73695B77B10300644F50E91D6B02FE79BB0CD4B78C7BA88CCE56F4B9408EC146361BF408F52D01A1F435183360C801EA5E219FB718247F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Helsinki) {.. {-9223372036854775808 5989 0 LMT}.. {-2890258789 5989 0 HMT}.. {-1535938789 7200 0 EET}.. {-875671200 10800 1 EEST}.. {-859773600 7200 0 EET}.. {354672000 10800 1 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {410220000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 EEST}.. {717555600 7200 0 EET}.. {733280400 10800 1 EEST}.. {749

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Isle_of_Man

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.914274131294981
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQaqpfioxp8QavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/ycS
                                                                                                                                                                                                                                                MD5:F9A0F19FAF3131D8A70C50FF21B365B7
                                                                                                                                                                                                                                                SHA1:7FC2B5302FAD06BC4C633CD22A80A7D40073FFF8
                                                                                                                                                                                                                                                SHA-256:2F1151B0528A5325443379D4E7CCE32C00213722AD9DF764E1DC90198084B076
                                                                                                                                                                                                                                                SHA-512:6D04DF4480FE132A6641C4BF7E01936E2E4A71A3A6C2AB9F7DA7A9D8A4B836BC66EE2BB597B8C318D07A06F72C05B07E6785B53308ED9BC1103AE6DBDD0FF24E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Istanbul

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3683
                                                                                                                                                                                                                                                Entropy (8bit):3.814835316757376
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:Qi0p05zvSPBUUl0ZFzo4ay0CREDcxn6nH78BV0QbCgkCPviiM0H7hdli80+j7x9L:Qiq66OFEIFMssCfMsXV3heM2MRlA0
                                                                                                                                                                                                                                                MD5:A8256656B971F58CB991BC270BF93B26
                                                                                                                                                                                                                                                SHA1:189796E1B8E29A7A7B8B0E143DD9B44BAF217AB2
                                                                                                                                                                                                                                                SHA-256:08061A80FC0F1EF375EEFE784EACDF0812E289FD67E8613BDEC36209985CA1D7
                                                                                                                                                                                                                                                SHA-512:1F11308B5BAC1F3DB75CAC7322BBEA6E51C6B4A2A3450F1DB84DE6AA127F0F1BAA7DAB409FAF1288C100BDA77DA6FA1C6E3C0BA962F9406D1445D7C9E2AA3A60
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Istanbul) {.. {-9223372036854775808 6952 0 LMT}.. {-2840147752 7016 0 IMT}.. {-1869875816 7200 0 EET}.. {-1693706400 10800 1 EEST}.. {-1680490800 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1440208800 10800 1 EEST}.. {-1428030000 7200 0 EET}.. {-1409709600 10800 1 EEST}.. {-1396494000 7200 0 EET}.. {-931053600 10800 1 EEST}.. {-922676400 7200 0 EET}.. {-917834400 10800 1 EEST}.. {-892436400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-764737200 7200 0 EET}.. {-744343200 10800 1 EEST}.. {-733806000 7200 0 EET}.. {-716436000 10800 1 EEST}.. {-701924400 7200 0 EET}.. {-684986400 10800 1 EEST}.. {-670474800 7200 0 EET}.. {-654141600 10800 1 EEST}.. {-639025200 7200 0 EET}.. {-622087200 10800 1 EEST}.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Jersey

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.8801202136140915
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQap6cEBx/yQavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yzx
                                                                                                                                                                                                                                                MD5:FE10770868A75F4F8D76C5E23D99AA81
                                                                                                                                                                                                                                                SHA1:30AC768BA47AF7A53831F5142B58ECEC41933621
                                                                                                                                                                                                                                                SHA-256:97EB33915ED7C9C34144F8F42357FAB2262B3CD45287F3CFFD26C33D65F7651E
                                                                                                                                                                                                                                                SHA-512:1D82DF45AB0CCDFBFAD0431C668794996E01776800F34DD4131C5287D37291657A749D497AA5B0AB81CAFF3190896633FBFF456BFFEB7E93A3420AA841E54842
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Jersey) $TZData(:Europe/London)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Kaliningrad

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2512
                                                                                                                                                                                                                                                Entropy (8bit):3.941165221943348
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:coNlj+X2uxhuHJkw0QqXknzaVV04v3TfdGY3kNmneVuNlh000sGpdh:coN9+1EpkwCXkSV3A8qc0
                                                                                                                                                                                                                                                MD5:104CCB93300F40BAF8F4D7CC882EFC05
                                                                                                                                                                                                                                                SHA1:EA83F3C3791BD6F083844939DC405B248E738FE3
                                                                                                                                                                                                                                                SHA-256:2387D26DF5429DF9867F42F7D4F872DC146643B4B3CC57DA7298C18561DE8BFE
                                                                                                                                                                                                                                                SHA-512:12724C5BBEE0835626A98B66BF55C3DF1311F07018C70D76FC5C50E7E7BA5C4A9F064D9EDC376CC3B06C4FFFECA3FAF5B66948615A03DFECA7C361E326D950EA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kaliningrad) {.. {-9223372036854775808 4920 0 LMT}.. {-2422056120 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780368400 7200 0 EET}.. {-778730400 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-749095200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Kiev

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):173
                                                                                                                                                                                                                                                Entropy (8bit):4.970386708540243
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV2cvXHAIgoq1csFARL/yQaoM2EBUQaocqn:SlSWB9vsM3ym5HAIgoiAN/yOEBUC
                                                                                                                                                                                                                                                MD5:74ACF46A3248341CFD84B1592F884A8F
                                                                                                                                                                                                                                                SHA1:888FBB54381A1B5BC19E65AF38A1913635A8E7E4
                                                                                                                                                                                                                                                SHA-256:05C55F87182F0D5D3E8E6C1F9164EDDBDB8035146A0955C04283BC1347D45B30
                                                                                                                                                                                                                                                SHA-512:21A752390E023CBD582BC43865D43458B44B036299A2373948269196071742ED7EB6067DD9A288F3A15E808B452FE4192750FAE813F70738FAB0C866219D57CB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Kyiv)]} {.. LoadTimeZoneFile Europe/Kyiv..}..set TZData(:Europe/Kiev) $TZData(:Europe/Kyiv)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Kirov

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2029
                                                                                                                                                                                                                                                Entropy (8bit):3.668326642402654
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:FFvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDM:FhCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
                                                                                                                                                                                                                                                MD5:57BB199152815B12FE4491C92FE25186
                                                                                                                                                                                                                                                SHA1:7BC5ECDE9EFADE812AF40CB92CCE5323FB57C78D
                                                                                                                                                                                                                                                SHA-256:60884D4B8B17A9AB8FB5697DA95F62E570755348109C661D783D56CD047BBE9E
                                                                                                                                                                                                                                                SHA-512:2043FDBA860E8F6578F7E26A80C7787B82C7D15188327923EC36D153FDF9BEEAE063012ACE4309B76DB9DBA2DFFB7404DE370BA85023CCE93159FCAD3B9B92B5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kirov) {.. {-9223372036854775808 11928 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {78044

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Kyiv

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7455
                                                                                                                                                                                                                                                Entropy (8bit):3.7624983280224953
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:vC1LyEpkv8V3MpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb4:vC9VW0bivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:F37C7529B53C4C158341AF90F80C3A11
                                                                                                                                                                                                                                                SHA1:210650A882350D35C72A934749F276C58C572DFA
                                                                                                                                                                                                                                                SHA-256:591264F69DB19DDCDC90E704525E2D3D3984117B710F482F19DA8F88628EE6A7
                                                                                                                                                                                                                                                SHA-512:F23B0C5251EB7418A1C80344AB7623D2A0197E681E3B7D152E416187BF66DE09A7A60A65F8ED6A810272CF0C253D63684F08AF594A8C22ABEA89E3BBADC8F0A0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kyiv) {.. {-9223372036854775808 7324 0 LMT}.. {-2840148124 7324 0 KMT}.. {-1441159324 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-892522800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-825382800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {646786800 10800 1 EEST}.. {686102400 7200 0 EET}.. {701827200 10800 1 EEST}.. {7175

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Lisbon

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9878
                                                                                                                                                                                                                                                Entropy (8bit):3.8275310275285723
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:j76abXsyZLEjx82YbtIaFF1w0us4qE3+sSGjT:j77bXsyZLEjx82atysLE3+sSGjT
                                                                                                                                                                                                                                                MD5:0DA331C2A815739E6758797BD24554EA
                                                                                                                                                                                                                                                SHA1:3829C441E908BEFDC4ED6AB65FD4ACD0C97D5E1B
                                                                                                                                                                                                                                                SHA-256:9FAC9812411F88014779D34722F3E0D2750E45BF21595DF1AE14CB9CCFD3F33F
                                                                                                                                                                                                                                                SHA-512:FEBBA05F64AC1F3066AF6351493DD89768154FD171D447503DAEDB90D16858BEDBCE4A74E24AC0C37B5FF191692AF44AADDE4A92E752F88C48DA646352AD9A0B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Lisbon) {.. {-9223372036854775808 -2205 0 LMT}.. {-2713908195 -2205 0 LMT}.. {-1830384000 0 0 WET}.. {-1689555600 3600 1 WEST}.. {-1677801600 0 0 WET}.. {-1667437200 3600 1 WEST}.. {-1647738000 0 0 WET}.. {-1635814800 3600 1 WEST}.. {-1616202000 0 0 WET}.. {-1604365200 3600 1 WEST}.. {-1584666000 0 0 WET}.. {-1572742800 3600 1 WEST}.. {-1553043600 0 0 WET}.. {-1541206800 3600 1 WEST}.. {-1521507600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1426813200 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1221440400 3600 1 WEST}.. {-1206925200 0 0 WET}.. {-1191200400 3600 1 WEST}.. {-1175475600 0 0 WET}.. {-1127696400 3600 1 WEST}.. {-1111971600 0 0 WET}.. {-1096851

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Ljubljana

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.948438246006353
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQavPSJ5Qahs0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNl
                                                                                                                                                                                                                                                MD5:56C6C95484FEAF9BAF755683E7417B58
                                                                                                                                                                                                                                                SHA1:A43176BEBC5B4D7144A7E1109E0AAEFD95C21EC6
                                                                                                                                                                                                                                                SHA-256:713A842197516D618F2D86977262542A1CA334D7DF6026539FA2F2980DBF4CD3
                                                                                                                                                                                                                                                SHA-512:566B6DF2D76A8A4D3405C4785C7A471A23D65CD8838831BD0DEDF5BF194E8A3B304CA9920CB4A8EC9D6CD60EAA9BE0335E38D9547A4D23C7E4E5E5A39A09DDAC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\London

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10211
                                                                                                                                                                                                                                                Entropy (8bit):3.826887992237191
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:GNoCvTZtcf80KYiK3BG0Myj9TYQOeMAwbccM0Fp:GNNTZtcf15iOBG08eNwbccM0Fp
                                                                                                                                                                                                                                                MD5:0625C99E16D3C956DED1C0C0F867DEC3
                                                                                                                                                                                                                                                SHA1:6ACDF0DB619B63E21EC89046B9320A85FBD3397A
                                                                                                                                                                                                                                                SHA-256:D04C4E25DF4DE1C1CFE1EF84B3B6DD746CF08A271AB0958F22C7D580A3ED10E6
                                                                                                                                                                                                                                                SHA-512:07AC42F0635DF01CC0AFD13F9668B143D4943BA0E4C377D254B5AF034D9DDBAB77BA813187E9AB73D2EEAD86EBAA26DC15599FD74FC82EEF287F5A6AB9C01635
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/London) {.. {-9223372036854775808 -75 0 LMT}.. {-3852662325 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Luxembourg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):191
                                                                                                                                                                                                                                                Entropy (8bit):4.920751023999728
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/So3vXHAIgoq82yHRL/yQavQLHKQX9J8QahCv:SlSWB9vsM3ymhS2HAIgoh26N/y1QzKQt
                                                                                                                                                                                                                                                MD5:E4A8C25756D6C5D2073A51D2B54E3A0C
                                                                                                                                                                                                                                                SHA1:4A24667ADC9BD31E8CB298BE3787C12301C3F1C8
                                                                                                                                                                                                                                                SHA-256:8C0486A5B235E8B01069420976E1B8D08D77A4BEF587203AF1B68D7B5333546E
                                                                                                                                                                                                                                                SHA-512:F3593C3B75C9DA931FB39BC2054EB9691C3A544A74F871425169C3244040D6D060510741FE1E352A1E59F53E5A585307D434A0D7C9D159D065717E78C807787C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Brussels)]} {.. LoadTimeZoneFile Europe/Brussels..}..set TZData(:Europe/Luxembourg) $TZData(:Europe/Brussels)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Madrid

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8517
                                                                                                                                                                                                                                                Entropy (8bit):3.8326167134909177
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:k5m01LdXKc0TJp+bwS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:+DaNVLSs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:63263380F57B756A1DFA3796E4188CD3
                                                                                                                                                                                                                                                SHA1:8EEE707AC4FEA1C098C81AC2D289A46239121A5E
                                                                                                                                                                                                                                                SHA-256:5337C9843C56DEEC6B91C4468C76EC1C896E80421B72B583B69DE5579063E09A
                                                                                                                                                                                                                                                SHA-512:ACA4830020715C471741E27EB2292ACF002D2CD7EDCD1061978B64967EB447F61AA095F960D8A75A01B9B87558D83FF409F30BDACA83E063024F1E2381FA64C4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Madrid) {.. {-9223372036854775808 -884 0 LMT}.. {-2177452800 0 0 WET}.. {-1631926800 3600 1 WEST}.. {-1616889600 0 0 WET}.. {-1601168400 3600 1 WEST}.. {-1585353600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269820800 0 0 WET}.. {-1026954000 3600 1 WEST}.. {-1017619200 0 0 WET}.. {-1001898000 3600 1 WEST}.. {-999482400 7200 1 WEMT}.. {-986090400 3600 1 WEST}.. {-954115200 0 0 WET}.. {-940208400 3600 0 CET}.. {-873079200 7200 1 CEST}.. {-862621200 3600 0 CET}.. {-842839200 7200 1 CEST}.. {-828320400 3600 0 CET}.. {-811389600 7200 1 CEST}.. {-796870800 3600 0 CET}.. {-779940000 7200 1 CEST}.. {-765421200 3600 0 CET}.. {-74849

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Malta

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8724
                                                                                                                                                                                                                                                Entropy (8bit):3.816380386871747
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:KAGvi2GmkwwnpH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZN:KLsww141sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:9B09D6EED8F23BAFFB62929C0115E852
                                                                                                                                                                                                                                                SHA1:4AEF15333C73C2836C09D818FD0E20440D7C4780
                                                                                                                                                                                                                                                SHA-256:C5C240BAAECE8235D1FBDD251C1A67CB2D2FC8195DD5BBE37FF9CFF0445FCDA2
                                                                                                                                                                                                                                                SHA-512:43AA3492BD335A290C6EFEE275B47EA18E544199E37A9BBAE2E350D42BDFF42F0E9ED461A4BB1824CA33F84A90D4060906844A3E22DA49C9821E4CB460832D6E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Malta) {.. {-9223372036854775808 3484 0 LMT}.. {-2403478684 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812588400 7200 1 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 3600 0 CET}.. {-81997200 7200 1 CEST}.. {-71715600 3600 0 CET}.. {-50547600 7200 1

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Mariehamn

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.959733196757503
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV1AYKjG5XHAIgoq2AYKjo0ARL/yQausWILMFJ8QaC:SlSWB9vsM3ymrAdjGJHAIgorAdjo0ANn
                                                                                                                                                                                                                                                MD5:C1844961691214F6E6DF6487788A7758
                                                                                                                                                                                                                                                SHA1:6D08E9FB7B8602A80622148BFACD9676F45F0E2B
                                                                                                                                                                                                                                                SHA-256:6136C3CFA4A767E7C9DDA23A283AD98B72E9868F192E6A8E3BFE6396F6989BD1
                                                                                                                                                                                                                                                SHA-512:B2D1EA51AC5B34792AC02820A9D60FD41F3B91AB6505896476FCB0DC339B8DC1DE9E2C89A7627F69E16247661AE8040D789FFD2F8F1CD59F243B57C4845B450F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Helsinki)]} {.. LoadTimeZoneFile Europe/Helsinki..}..set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Minsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2177
                                                                                                                                                                                                                                                Entropy (8bit):3.9354590900153172
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:K8cVnR7xhuHJkminzaVV04v3TfdGY3kNmneVuNlh000sGpde:5mnRtEpkmiSV3A8qcN
                                                                                                                                                                                                                                                MD5:9C10EAE9FA0DE192C5FD4F76E12606F0
                                                                                                                                                                                                                                                SHA1:AFD5650410EC3E6ED564A8B2ABF91709D090B4AD
                                                                                                                                                                                                                                                SHA-256:8C95EA696EA578DEF726502AC181AF475A676030878F56B4E2D667757BBD1C49
                                                                                                                                                                                                                                                SHA-512:3B9ED6B68858485B9A46A0863B7D9D3C1E4C5BBA269457F24A9A12C274F0F9B35E63D8C25EB53E7200DB57DD35ACCB7FD7D8AB005FEE2C4D7FC6E72E8CF57194
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Minsk) {.. {-9223372036854775808 6616 0 LMT}.. {-2840147416 6600 0 MMT}.. {-1441158600 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-899780400 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-804646800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {670374000 7200 0 EEMMTT}.. {670377600 10800 1 EEST}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Monaco

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.9089012087310095
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVtEXc4o3vXHAIgoquEXeRL/yQauPMFBx6QazEXcov:SlSWB9vsM3ymzESPHAIgozEON/ySRpEB
                                                                                                                                                                                                                                                MD5:2015CF8BBEEE12AF0D9C82FD2E246C72
                                                                                                                                                                                                                                                SHA1:062BFFBB266C3EBB5776A509DDB7A6044C82B864
                                                                                                                                                                                                                                                SHA-256:9DF16BB1C26100635DC4CB1DF409B0FA7B139C22BF09574ED337EE244CA3C546
                                                                                                                                                                                                                                                SHA-512:FD3479588D4F3B84CF6C8B8A5DB1AB3BFA0A87CA2FFADB4FEBBBB25711C77963BE7CD0D1DA5ED985D729F39C5B44E8CBD429F1E2DA813DF26272D66CAE4F425A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Paris)]} {.. LoadTimeZoneFile Europe/Paris..}..set TZData(:Europe/Monaco) $TZData(:Europe/Paris)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Moscow

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2430
                                                                                                                                                                                                                                                Entropy (8bit):3.942836780611272
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:7fnjazk7e+LxhuHJkvVineTeCTU50x0Y7:7fnjazk7eoEpkvVieTeCTUax0Y7
                                                                                                                                                                                                                                                MD5:4547D47E9364ACAFB2A4BEE52D04BFBB
                                                                                                                                                                                                                                                SHA1:1E7F964692F81D49AEAF581FE70AD22D4E36226B
                                                                                                                                                                                                                                                SHA-256:31F9C3C2F17B3EE4FA6D9EE6A86BF407AC0377DE4D666C65E86CE5AC591F829F
                                                                                                                                                                                                                                                SHA-512:7F1D7C80A1BF611D5440EEF9085DA6CDED86B5EF4C2737C105640030E5AA998A0951182E72DC224190A25DA8846CDE856A78EBAA8876AA0B18B1CBCADBB060FF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Moscow) {.. {-9223372036854775808 9017 0 LMT}.. {-2840149817 9017 0 MMT}.. {-1688265017 9079 0 MMT}.. {-1656819079 12679 1 MST}.. {-1641353479 9079 0 MMT}.. {-1627965079 16279 1 MDST}.. {-1618716679 12679 1 MST}.. {-1596429079 16279 1 MDST}.. {-1593820800 14400 0 MSD}.. {-1589860800 10800 0 MSK}.. {-1542427200 14400 1 MSD}.. {-1539493200 18000 1 +05}.. {-1525323600 14400 1 MSD}.. {-1491188400 7200 0 EET}.. {-1247536800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Nicosia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.7873368289068905
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85GKLlXHAIgNwMGKLZRRL/yQatHefeWFKYGKL8n:SlSWB9vsM3yZdL1HAIgGMdLZRN/y3HeA
                                                                                                                                                                                                                                                MD5:BE82205480617CF07F76BA0DF06C95BC
                                                                                                                                                                                                                                                SHA1:46D2D8D9FE4FB570C2A09BC809B02C8960F9601F
                                                                                                                                                                                                                                                SHA-256:FC93B7516933EDFDC211AC0822EE88BF7ACAD1C58A0643B15294F82EB0F14414
                                                                                                                                                                                                                                                SHA-512:F490A70053A6011D80FB0A4E96D2871BFEEB168690E21C4EC31F2F5C0E24A67C706528C81322A1D48E71242F0FFA277550192925FDE5B1F34BFCB308290E11FC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Nicosia)]} {.. LoadTimeZoneFile Asia/Nicosia..}..set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Oslo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.910647918749938
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/y+YF3vXHAIgoq8yFRRL/yQasWJAQahyuv:SlSWB9vsM3ymhVoPHAIgoh6N/yI7Fv
                                                                                                                                                                                                                                                MD5:242748F361AD524CD8E288BEE8611E19
                                                                                                                                                                                                                                                SHA1:A636A544BB54851185E2BE83DAC69C813B824827
                                                                                                                                                                                                                                                SHA-256:C84E9C0D22059573079211CBF487072CAB95C14B5ECEFB596CF1F594ABD3458C
                                                                                                                                                                                                                                                SHA-512:404B272D0C6B70332052601EA65C0F7AE71C12F62D19FD3010BBA6FB25E4F2F95BB9E5F295D8494CBADB1AE9C7F833C42382AE7488317EA6F0C20E60B63BEFE8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Berlin)]} {.. LoadTimeZoneFile Europe/Berlin..}..set TZData(:Europe/Oslo) $TZData(:Europe/Berlin)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Paris

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9152
                                                                                                                                                                                                                                                Entropy (8bit):3.8506895725632746
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:fySTO1C+4qoMYOKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdi:fdp+3Ss41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:9CAF8C5C5AF630E7F782C0480DD786E7
                                                                                                                                                                                                                                                SHA1:9FBEF9EEDD8BAFB48B17E3AC388CFEF8DCD10CB0
                                                                                                                                                                                                                                                SHA-256:AE61491C4A587F56426A9F2118E31060276F2B0231E750C461781577551CA196
                                                                                                                                                                                                                                                SHA-512:F809744BB597184A2815758A27B6A07C515C65DB96CFFB3625FD059DEBBF05EE903E999483B3459C7C8D3991824746F8530CD1378F8A63B1F54F60CFACE9F89B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Paris) {.. {-9223372036854775808 561 0 LMT}.. {-2486592561 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800 3

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Podgorica

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.910162937111088
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQazKIGl1/yQ0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNK
                                                                                                                                                                                                                                                MD5:52C36955D6BD1D9FE9CB64822D04B6DB
                                                                                                                                                                                                                                                SHA1:D5FF82EC486409E6FB314AD5ACE608577C9632CF
                                                                                                                                                                                                                                                SHA-256:B87630FF459DE07EB16CD0C2452660772E3FFC4EEB8419EA77A013B6F63A5900
                                                                                                                                                                                                                                                SHA-512:ABA49D3F05A41A4982600E4DA5C225D8994251F447401EE6FE8478E008BCD5D41C057034185B5CFF805634D571F3CC98EFE98093ABC8E6271351E11A4DA1E7AD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Prague

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8038
                                                                                                                                                                                                                                                Entropy (8bit):3.8240363895915914
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:Kr9+neXAS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlh:KnASs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:828134FA1263FEFA2B06A8B2F075F564
                                                                                                                                                                                                                                                SHA1:4B332DE6E0855F8B9517F7098A3FB439671FC349
                                                                                                                                                                                                                                                SHA-256:5D3AFED5C1B07C6C6635D6BDEB28A0FB4D11A61F25F26C91227B2254BE5F4AA0
                                                                                                                                                                                                                                                SHA-512:9AB1462CDBD7F13F0CECDCCC2D91A85D8C0576B71508F935D26638C25ED023CF8FF4BA4FFDA402B308E6142B135D1B9D88700A519DBE2381E8E945329A5354F7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Prague) {.. {-9223372036854775808 3464 0 LMT}.. {-3786829064 3464 0 PMT}.. {-2469401864 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-777862800 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-746578800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-728517600 0 1 GMT}.. {-721260000 0 0 CET}.. {-716425200 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654217200 7200 1 CEST}.. {-639010800 3600 0 CET}.. {283993200 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Riga

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7658
                                                                                                                                                                                                                                                Entropy (8bit):3.7750218768791806
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:eq+cEpkjXkSV385aNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:ePWjUS7ivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:0D3C919F60081388524BD5DB22E6904B
                                                                                                                                                                                                                                                SHA1:6691EAB901C8B57D2F2693120A45A67799D05FCB
                                                                                                                                                                                                                                                SHA-256:8B64A42BAFD90F9255CACFDBAC603D638DD7C18DC27249F9C9B515E1DA634424
                                                                                                                                                                                                                                                SHA-512:62A2820B8C1C5468AC1F1BB626F9AAAD0BA1DEC5B73740F00FE4DB8CFA3F2BCF9947968E693824FC8770BA20AB962F93F7E5E345AE8A85F99CDB18E2B510308E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Riga) {.. {-9223372036854775808 5794 0 LMT}.. {-2840146594 5794 0 RMT}.. {-1632008194 9394 1 LST}.. {-1618702594 5794 0 RMT}.. {-1601681794 9394 1 LST}.. {-1597275394 5794 0 RMT}.. {-1377308194 7200 0 EET}.. {-928029600 10800 0 MSK}.. {-899521200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-795834000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {6

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Rome

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8813
                                                                                                                                                                                                                                                Entropy (8bit):3.8168470239811736
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:hhGvC2GmkNXEq74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:hUsF41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:C4F49446D3696301EDB339691DCB2FDB
                                                                                                                                                                                                                                                SHA1:537963A77B9BE9BE6B997A812A6E6DD120F6F247
                                                                                                                                                                                                                                                SHA-256:DCD2D9144507311E573568598E1FFD0E0574FB677AA0DAFC5641D80A19EB6E58
                                                                                                                                                                                                                                                SHA-512:1F0A9A549FA0995C51E90AC392671E3F09744B268F1EE6A27CA7E3C41C2B02A4BA0F98369BE40BA482FBA1FED8F1EE712F0B3217AD86164D1AD498E369C24D76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Rome) {.. {-9223372036854775808 2996 0 LMT}.. {-3252098996 2996 0 RMT}.. {-2403565200 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-830307600 7200 0 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-807152400 7200 0 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 36

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Samara

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2118
                                                                                                                                                                                                                                                Entropy (8bit):3.664269700453612
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:7PvCAs6kKR6aQmF1cSNWrI+AjQnTRYZ/YF0LUdt/LkajuZbIJltiabs2Tb:7HCAs6kC6aZF1cSN4I+AjQTRYZ/YF0Lw
                                                                                                                                                                                                                                                MD5:965D987F6576F66A08871697144D4CDB
                                                                                                                                                                                                                                                SHA1:AF7226DF81C2B3C3A5832F59FC708A6BCBF389CA
                                                                                                                                                                                                                                                SHA-256:8F395352AA05D35E7D13380E73659A0D5B56FFC17E3F4E40E4F678A902F0E49B
                                                                                                                                                                                                                                                SHA-512:B82E0CFA5EDA0FCDF03609AE439255F8937A7E9EFA0AFE15EA8877316782AFC74514BCD2B4F06F1B5F0F3C5A64A933D73CB50D5AED2BB1491BD6CACBB77B10E8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Samara) {.. {-9223372036854775808 12020 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-1102305600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 10800 0 +03}.. {687916800 14400 0 +04}.. {701820000 18000 1 +05}.. {717544800 14400 0 +04}.. {733

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\San_Marino

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.955758257767983
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQawELDX7x/yQaxE:SlSWB9vsM3ymx5PHAIgoxvN/yt/yrE
                                                                                                                                                                                                                                                MD5:D253DA6880630A31D39DB0CFA4933ABD
                                                                                                                                                                                                                                                SHA1:E5798DAAE574729685FE489F296B964BC1CCF2E4
                                                                                                                                                                                                                                                SHA-256:B6856A0E38C2404F7D5FA1821559503F8AE70923A562F0D993124D131515F395
                                                                                                                                                                                                                                                SHA-512:CFB6005F3E8D1C585AF36EB7A8C9F49760EF6F446C97E7804EB61EFD0804424C4FB6AE81B71C5A867274EF89A17DAC0D2A0FF882A0F6AEA1D5FFD51593726C5F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/San_Marino) $TZData(:Europe/Rome)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Sarajevo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.937834327554967
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawEX3GEaQa5:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNZ
                                                                                                                                                                                                                                                MD5:F7C7DAE9C5D371EF9EE1F490246ED3CC
                                                                                                                                                                                                                                                SHA1:40C388FE2A55078C8E0524A4385B3F8846960E24
                                                                                                                                                                                                                                                SHA-256:BC00D953C2F3E55E40EDA13838AB66B9E9D0BDAD620E4EB917637761ABB06FB1
                                                                                                                                                                                                                                                SHA-512:EB22C59F4D58D96797A718FC59B010795F587626E456D44A3E6398E0FBF4ECD97BCDC151BC1359151798B5AF2964FE5708233F8ECD0D344C3E27629F2645687F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Saratov

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2061
                                                                                                                                                                                                                                                Entropy (8bit):3.6638125261109824
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:yFvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDQ:yhCAs6kC6aZF1cSNcjXgV/ApDFjDQ
                                                                                                                                                                                                                                                MD5:CC4D7C478790588D232568CAB12D8E67
                                                                                                                                                                                                                                                SHA1:07A7CFCFFFF91D124EDFC99F5053BAFC79FBB12B
                                                                                                                                                                                                                                                SHA-256:AB90363DEE5077C39EC55FE8E519593FF08223E5A8E593F6CCE01FB5B8B35BAE
                                                                                                                                                                                                                                                SHA-512:23944D20624C942CFDE58F1019160D64401BD0AFB8C3EC49F904038482FAA6741812548C860A2DAE050B8D17A7E08ED9C6EBE7FF19393CFA46D78B1D21B1CACA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Saratov) {.. {-9223372036854775808 11058 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {780

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Simferopol

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2389
                                                                                                                                                                                                                                                Entropy (8bit):3.9491446081772748
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:wM2wE0xhuHJkYaVV0XOnbdSisa0ewEKGfUslIYtq8X:UwEAEpkzVFgaNl7
                                                                                                                                                                                                                                                MD5:03E05E60E064198BF6562B2E6E8DA8D2
                                                                                                                                                                                                                                                SHA1:51461207B671536CD4A7587BA283DE2D0017AA4A
                                                                                                                                                                                                                                                SHA-256:D51CD3DE50C50BCA1624EFC952ADD15D418A09EC213760DF5BC3097E35C5A7A0
                                                                                                                                                                                                                                                SHA-512:73B7773DABE19F20DD211E178B822FD35620DC4AC8B9D20259971B1157ED7A60A5A41026258FAA8B15016268D241ED804AC1307CACDA00D6FE657407D254B02C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Simferopol) {.. {-9223372036854775808 8184 0 LMT}.. {-2840148984 8160 0 SMT}.. {-1441160160 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-888894000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-811645200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 7200 0 EET}.. {701042400 7200 0 EET}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Skopje

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.953089768975736
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawOgpr8Qahr:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNO
                                                                                                                                                                                                                                                MD5:0BF8ADBB63F5D6187C75FF1B0BAC761E
                                                                                                                                                                                                                                                SHA1:7DE15E767D34812F784CE6E85438A592E2CBA418
                                                                                                                                                                                                                                                SHA-256:52F20858433261B15797B64F0A09CEE95D552EF93B5DAA7C141BFAB6D718C345
                                                                                                                                                                                                                                                SHA-512:27D395635427C8FA1A4E0063A32F482701D2CC7C7724B4A06E661D4A419D23E219672888D37367FE5E70B6872914EB9EE034AE359DCB6A4C4CE05CA34C3589A9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Sofia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7654
                                                                                                                                                                                                                                                Entropy (8bit):3.727428614069594
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:8lmG4+K7Gjz5CXNUatpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:8lmGWwkdUasivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:91357DFC23ADB0CE80C463E4B6D896BE
                                                                                                                                                                                                                                                SHA1:273F51BE4C67A9AC1182F86AC060E963684151D5
                                                                                                                                                                                                                                                SHA-256:6415F279CB143EA598CF8272263AC5B502827B10CEEB242B39E6EFCC23A2EE12
                                                                                                                                                                                                                                                SHA-512:8EA7E2D4C2239879A4D6CCE302C38A6D2A9093A2CADEF4F4294E60D373AB9A2C468BA6E3D54DEC7F73D954CE5226EF2B022F8BDEF29B3B4AAB3838B05C72EA29
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Sofia) {.. {-9223372036854775808 5596 0 LMT}.. {-2840146396 7016 0 IMT}.. {-2369527016 7200 0 EET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-781048800 7200 0 EET}.. {291762000 10800 0 EEST}.. {307576800 7200 0 EET}.. {323816400 10800 1 EEST}.. {339026400 7200 0 EET}.. {355266000 10800 1 EEST}.. {370393200 7200 0 EET}.. {386715600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465350400 7200 0 EET}.. {481075200 10800 1 EEST}.. {496800000 7200 0 EET}.. {512524800 10800 1 EEST}.. {528249600 7200 0 EET}.. {543974400 10800 1 EEST}.. {559699200 7200 0 EET}.. {575424000 10800 1 EEST}.. {591148800 7200 0 EET}.. {606873600 10800 1 EEST}.. {62259

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Stockholm

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.956798438511978
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/y+YF3vXHAIgoq8yFRRL/yQawRMNSTyQahyuv:SlSWB9vsM3ymhVoPHAIgoh6N/yqMNSTm
                                                                                                                                                                                                                                                MD5:ACFB8E2D1D4BA0D2D46410F2F2823B21
                                                                                                                                                                                                                                                SHA1:4AC3A19E94DE606DFF7D93BC6C7F113F3D2D083A
                                                                                                                                                                                                                                                SHA-256:64615AEA9EF14A2609D2C804901281C83FDDC0A8BCA9B377D6CAD62D81801C66
                                                                                                                                                                                                                                                SHA-512:2E23AC0DE7D3D0CF2BA4FE3EE31E15EB614A7442097578209D38CE2FF2E3DF006881463866FE67DD4DDEAB179E5CD2946E8A9E8F7401F1B953E9AB216EC753F0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Berlin)]} {.. LoadTimeZoneFile Europe/Berlin..}..set TZData(:Europe/Stockholm) $TZData(:Europe/Berlin)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Tallinn

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7549
                                                                                                                                                                                                                                                Entropy (8bit):3.76585669030767
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:dUusEpkjXkSV3AMaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:O0WjUSWivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:54EF0224F5E28FA78F212EC97D4AE561
                                                                                                                                                                                                                                                SHA1:FA7C9A951ED943F1E1E609D2253582016BC26B57
                                                                                                                                                                                                                                                SHA-256:6F3594CCDA78B02B2EE14C8FAE29E668E47193AF2DFCF5AF1ECD210F13BCE9CE
                                                                                                                                                                                                                                                SHA-512:2D1CA2BB1945AE5E3F56AF8FA7F950CE7169F215C783E683634581C5EC01B54159E47A0E9551897077BBEAB06158906029A4E4B0051A263D9E5D903EA9DA1692
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tallinn) {.. {-9223372036854775808 5940 0 LMT}.. {-2840146740 5940 0 TMT}.. {-1638322740 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1593824400 5940 0 TMT}.. {-1535938740 7200 0 EET}.. {-927943200 10800 0 MSK}.. {-892954800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-797648400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 10800 1 EEST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Tirane

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7675
                                                                                                                                                                                                                                                Entropy (8bit):3.809498345470167
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:n05NWKIHBJ9AE4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt:0iKqxAE41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:1983B88075A92942209BB2B80E565F4E
                                                                                                                                                                                                                                                SHA1:12A0401026C5C036144FD1D544173AAB39969F61
                                                                                                                                                                                                                                                SHA-256:C62686BF598138FEFB72E8CC6632BA75A5FE147F2A30124EE3583BE1F732E38D
                                                                                                                                                                                                                                                SHA-512:E95C38FA0A2B526C00B9DCF5CDF53059DECF64B085AA18BE000968DA626561944415D053CF7A5C32BC672085538920CFD67A3A3B627CFD5B1A4C9CEC49AA3F96
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tirane) {.. {-9223372036854775808 4760 0 LMT}.. {-1767230360 3600 0 CET}.. {-932346000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-843519600 3600 0 CET}.. {136854000 7200 1 CEST}.. {149896800 3600 0 CET}.. {168130800 7200 1 CEST}.. {181432800 3600 0 CET}.. {199839600 7200 1 CEST}.. {213141600 3600 0 CET}.. {231894000 7200 1 CEST}.. {244591200 3600 0 CET}.. {263257200 7200 1 CEST}.. {276040800 3600 0 CET}.. {294706800 7200 1 CEST}.. {307490400 3600 0 CET}.. {326156400 7200 1 CEST}.. {339458400 3600 0 CET}.. {357087600 7200 1 CEST}.. {370389600 3600 0 CET}.. {389142000 7200 1 CEST}.. {402444000 3600 0 CET}.. {419468400 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {457480800 7200 0 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 C

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Tiraspol

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.906212162381389
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV+NM/LWXHAIgoq9NM/HARL/yQa3MPgJM1p8QagNMj:SlSWB9vsM3ymI6CHAIgoI6HAN/ytM4MO
                                                                                                                                                                                                                                                MD5:E0C99DB7673EEE440BA1848046455BA1
                                                                                                                                                                                                                                                SHA1:1BCCC1BE46306DEF8A9CA249DE8FA11FC57CC04D
                                                                                                                                                                                                                                                SHA-256:FDD53FDB5F754BBBA8FF98F0B1555FE0BAEB7852843220A7CF93A190B641A9AD
                                                                                                                                                                                                                                                SHA-512:CD56B540AE9084DEAA9D0A1DBBAF89733C465424C22CE74696B9AE90FD4FEFAB265CF23C5B13A7F04597D75FD0147BD593E0552B56D87372170CB4CA1BFC8259
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Chisinau)]} {.. LoadTimeZoneFile Europe/Chisinau..}..set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Ulyanovsk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2119
                                                                                                                                                                                                                                                Entropy (8bit):3.680951255407528
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:kFvCAs6kKR6aQmF1cSNWrI+AjQndgV/Ap40FjDOP:khCAs6kC6aZF1cSN4I+AjQdgV/ApDFj4
                                                                                                                                                                                                                                                MD5:83C86E437B5FBA1DC9CC5235396AC381
                                                                                                                                                                                                                                                SHA1:5493A59C3A5A1B55ACD493E67F9E29D2A415A8DB
                                                                                                                                                                                                                                                SHA-256:9FA9D09509B4F8F5A9C8E422DBA02605070C3EBDAEB7C1DF8527C8EEF5E3632D
                                                                                                                                                                                                                                                SHA-512:86222489C65C87646939DECF91C2EC336EB46F64B644526A3FA8A4854B9D11819F6FD253107AB8A3DE911E254C88092D25137442164A6E437CDAF258A7CBB66C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Ulyanovsk) {.. {-9223372036854775808 11616 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 7200 0 +02}.. {695779200 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Uzhgorod

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):177
                                                                                                                                                                                                                                                Entropy (8bit):5.051734481833866
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV2cvXHAIgoq1csFARL/yQa2rUQaocqn:SlSWB9vsM3ym5HAIgoiAN/yFC
                                                                                                                                                                                                                                                MD5:17A0CC51331756920B13FFA3FF556751
                                                                                                                                                                                                                                                SHA1:C575FEF4F053393C57B34C7C7B0C1E9605413792
                                                                                                                                                                                                                                                SHA-256:F8CAF5DBE12F1647B28E7CCDDB2E09E36788A766690D12E770A8ABD82E708644
                                                                                                                                                                                                                                                SHA-512:E73F0FE5BE4DD91948A88DC895E148D81267576BA3BCFEA777E25C01EAE9C06845DBFFB651526045B70B7A3CCDB195DFFF60486C01E0A115DFB856873970008E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Kyiv)]} {.. LoadTimeZoneFile Europe/Kyiv..}..set TZData(:Europe/Uzhgorod) $TZData(:Europe/Kyiv)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Vaduz

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.953146873643623
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQa1NEHp8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/yvNEJ8G
                                                                                                                                                                                                                                                MD5:A0BAEC8B6AF1589ECBE52667DDB2A153
                                                                                                                                                                                                                                                SHA1:37093F4F885CBFA90A1F136D082E8B7546244ACC
                                                                                                                                                                                                                                                SHA-256:06B235BF047FC2303102BC3DC609A5754A6103321D28440B74EEC1C9E3D24642
                                                                                                                                                                                                                                                SHA-512:DBEC235AFB413FA8D116FA1AFFE73706762E7458038B6D68E0BFD71C339510D766825BA97055A06DEE14D5880EAE6CD035BFE0C935C0DF44B0107A356D293A78
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Vatican

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.914414313741477
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQa1xLM1p8QaxE:SlSWB9vsM3ymx5PHAIgoxvN/yvN+8rE
                                                                                                                                                                                                                                                MD5:2404265F8DE1F7D7745893DD4752BA1C
                                                                                                                                                                                                                                                SHA1:C07E7F72DBDC7F5F746385523EA733C2714F5DA2
                                                                                                                                                                                                                                                SHA-256:C203E94465BD1D91018FC7670437226EF9A4BB41D59DDE49095363865CA33D00
                                                                                                                                                                                                                                                SHA-512:5C20834542B74041AAB1DBE35686781B32EEB5814B1A35A942E87D1FC3B6D8F9264CB90433C44A480EA86DDEA65D8C152F41CE3E983C1DE5FA74D6FB5208F701
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/Vatican) $TZData(:Europe/Rome)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Vienna

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7930
                                                                                                                                                                                                                                                Entropy (8bit):3.8193566380830273
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:8F6zq+gH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:8ozE41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:6A3A8055DD67174E853C7A208BABAC9B
                                                                                                                                                                                                                                                SHA1:64445543DE9D6C01FA858442976E249E37BE23EF
                                                                                                                                                                                                                                                SHA-256:A8165313C9B51DAEF130401439CBA60DAA9887FC5EAA61A5AFD4F7BAD1AD934F
                                                                                                                                                                                                                                                SHA-512:4407B9E8709A8DD05337A10030895AA9876EAF64EF5347952249EE2A541E304331B46D38532FD7CDFF9E633BF8C9884282F0A5ED259EBA1D99DC0914AF1A50C6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vienna) {.. {-9223372036854775808 3921 0 LMT}.. {-2422055121 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1577926800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555801200 3600 0 CET}.. {-938905200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780188400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {323823600 7200 1 CEST}.. {338940000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CE

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Vilnius

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7485
                                                                                                                                                                                                                                                Entropy (8bit):3.7711709848169592
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:FAhEpkwCXkSV3A/PplKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:FfWHUSKivBeRF+W35Syrwl9h5j
                                                                                                                                                                                                                                                MD5:1AB5FCEACC4E09074BA9F72F0B7747D5
                                                                                                                                                                                                                                                SHA1:E0134E61EC0ADC60BF6DB4544EA7B7FFA4EC7857
                                                                                                                                                                                                                                                SHA-256:B762DB4A068DC79FA57691E070D7026086E5A6D2FC273D5C1872E7C8E3711533
                                                                                                                                                                                                                                                SHA-512:07565071D05CF972DD64F6060599EB68A00BF264172873BA310168AD07CE0CFCF90D0019B775433EC910DA748B89F0C614E7FD4E821993DA53C7E33F194C6A97
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vilnius) {.. {-9223372036854775808 6076 0 LMT}.. {-2840146876 5040 0 WMT}.. {-1672536240 5736 0 KMT}.. {-1585100136 3600 0 CET}.. {-1561251600 7200 0 EET}.. {-1553565600 3600 0 CET}.. {-928198800 10800 0 MSK}.. {-900126000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-802141200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 7200 0 EEMMTT}.. {606873600 10800 1 EEST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Volgograd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2123
                                                                                                                                                                                                                                                Entropy (8bit):3.667144931158014
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:menvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDqR:mevCAs6kC6aZF1cSNcjXgV/ApDFjDqR
                                                                                                                                                                                                                                                MD5:53E5BA5747B3255BB049F6FF651CEE25
                                                                                                                                                                                                                                                SHA1:A69E2BFDB89AC8756E1CD2EAA9109ACD924A0850
                                                                                                                                                                                                                                                SHA-256:22968D40DAC2B669E6D2BC43ED6B16C8A9CA3E1F9DACBF8B246299C3C24CC397
                                                                                                                                                                                                                                                SHA-512:3269D20DF9C9DDFF8252F33ED563B118771FC71049542DA7C6678E0B5B75FFEA00845FA6F3BC26EDABB4BB7CE449B0B7E00B72473D8D95F126AB3893A9A969B4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Volgograd) {.. {-9223372036854775808 10660 0 LMT}.. {-1577761060 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-256881600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Warsaw

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8662
                                                                                                                                                                                                                                                Entropy (8bit):3.8187545871488995
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:ELn9M9Nivtctwwoy4qelPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCso:E6Nivtctgq1sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:992C1D268E336AF1FB8200966C111644
                                                                                                                                                                                                                                                SHA1:C893B82224C8EF282DB2E16A5BBCC3A21C49B6FE
                                                                                                                                                                                                                                                SHA-256:F9DC10EC2AE2CC810A6C08837059B34BE651900BA4E1CEDB93C209972CCFB5A2
                                                                                                                                                                                                                                                SHA-512:EC4E0D8684D57FA66144F11D8E8C80E5272D4A7304300FEBE20E236476C1B8B33BBC5E479BF96D9ED12900FE6D41DD1DC0D11CBE02B89E0C4C7A153B4BFBCB1F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Warsaw) {.. {-9223372036854775808 5040 0 LMT}.. {-2840145840 5040 0 WMT}.. {-1717032240 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618696800 7200 0 EET}.. {-1600473600 10800 1 EEST}.. {-1587168000 7200 0 EET}.. {-931734000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 0 CEST}.. {-796608000 3600 0 CET}.. {-778726800 7200 1 CEST}.. {-762660000 3600 0 CET}.. {-748486800 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-397094400 7200 1 CEST}.. {-386812800 3600 0 CET}.. {-371088000 72

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Zagreb

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.899266605519742
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQa5rXv1/h8Q0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNB
                                                                                                                                                                                                                                                MD5:B07D9D3A5B0D11A578F77995A5FBE12B
                                                                                                                                                                                                                                                SHA1:1C4E186F2D53C0A1E6A82A6D33B172E403A41D6D
                                                                                                                                                                                                                                                SHA-256:A49B3894EB84F003EB357647D6A40CEAF6213523196CC1EC24EEFD7D9D6D3C3E
                                                                                                                                                                                                                                                SHA-512:43520AE325980B236C47C866620D1DA200AC0CD794E8EB642D2936D4B0ECEFE2DA0A93C9559D08581B3CCE2BC75251A4D5B967D376B16EB0C042B0ADCE1DCD01
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Zaporozhye

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.999265802825238
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV2cvXHAIgoq1csFARL/yQa58KXkcAEfh8Qaocqn:SlSWB9vsM3ym5HAIgoiAN/yjzVbh8C
                                                                                                                                                                                                                                                MD5:5B150E25521FE5DD8B83DD9B1B8F3A7A
                                                                                                                                                                                                                                                SHA1:0BB6F73F2C4B2464F3B1E62138843389AF1A07BC
                                                                                                                                                                                                                                                SHA-256:EF928AC09B9A366FD015F488B6A19FEFD72DE1BAF34E5CADFB8334946BCF19FE
                                                                                                                                                                                                                                                SHA-512:4A85A4E929EC6FE66AE60899FA55A75156D075CB2FE41C19337A128F5FA7363B9208AC2DC1BF4E44B76D5F115143D73F6D923E255EA78538D1BE4E45DEBA2049
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Kyiv)]} {.. LoadTimeZoneFile Europe/Kyiv..}..set TZData(:Europe/Zaporozhye) $TZData(:Europe/Kyiv)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Europe\Zurich

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7305
                                                                                                                                                                                                                                                Entropy (8bit):3.8199799674700277
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:94hH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:9Y41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                                                                                MD5:EBD66FAEA63E1B90122CC1EB21634ECE
                                                                                                                                                                                                                                                SHA1:C6487BB8AB2A6A72B2170B220F383ADB6B9AC91C
                                                                                                                                                                                                                                                SHA-256:95AFA61E439CA38551306D8FDB11C2788D935C42768D0407C9E4337F105A3E93
                                                                                                                                                                                                                                                SHA-512:25A8D0ED9BBE6BF23A1A76CC6D5378CF4D50544AA22DA97DDCD0673D7A5CCFEFFD81B660A1AEFB254B8BBEA55F6EF734BBBD3F0CB903E0721BE107667CA1E328
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Zurich) {.. {-9223372036854775808 2048 0 LMT}.. {-3675198848 1786 0 BMT}.. {-2385246586 3600 0 CET}.. {-904435200 7200 1 CEST}.. {-891129600 3600 0 CET}.. {-872985600 7200 1 CEST}.. {-859680000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\GB

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):170
                                                                                                                                                                                                                                                Entropy (8bit):4.8978035005721265
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/wox6QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/wRj
                                                                                                                                                                                                                                                MD5:68667037110E713DB3F51922DDE929FE
                                                                                                                                                                                                                                                SHA1:2EB02BE3FD35F105B59847892A78F1AA21754541
                                                                                                                                                                                                                                                SHA-256:E20D829C605A7C5B2A96B83C3480DF28C964A13381A8BD2C72C2A37295131FA7
                                                                                                                                                                                                                                                SHA-512:3A8CC2EC9E3053283F996CA2C4B422061D47F1D16CA07985CBA2C838DF322C23CC9DD28033646F22EAE0E401781480B9D3AF82A539444166A4DD9B7BCCAE45FE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB) $TZData(:Europe/London)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\GB-Eire

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):175
                                                                                                                                                                                                                                                Entropy (8bit):4.90874180513438
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/w4b/h8QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/w4E
                                                                                                                                                                                                                                                MD5:625520BAAB774520AC54BFB9EDCF9FCA
                                                                                                                                                                                                                                                SHA1:C72F0FD45F448901C6B2E24243175729591B9A54
                                                                                                                                                                                                                                                SHA-256:C9334480D0A970254B6BA6FF22E958DC8DD8BF06288229461A551C7C094C3F1D
                                                                                                                                                                                                                                                SHA-512:1B672218FF9C86168E065A98C3B5F67DAB710D1C2A319E9D6599B397C4B4C00D3721B76C735C8AB04BCB618C1832B07F6CCDAF4266CC0D12A461A3A862D1AEB2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB-Eire) $TZData(:Europe/London)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\GMT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):153
                                                                                                                                                                                                                                                Entropy (8bit):4.867609984313873
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wZ8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wZ8RQy
                                                                                                                                                                                                                                                MD5:A01FE6FC260711F0E11C85DC3DE3550A
                                                                                                                                                                                                                                                SHA1:988311B71498591425C63669DC3F802F270B2C44
                                                                                                                                                                                                                                                SHA-256:747C15CDC239855D5380B7A7F47112F2A26C61B0BF300EEB9711E6521550D189
                                                                                                                                                                                                                                                SHA-512:BE4678DCBAE5DBC72865665413206C1909F28BA54F4943257870EFFBA6525457866DED7A985E89F2689C810B314DE4AA2FA3A0A1826A664727F5F7113AA56595
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\GMT+0

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):155
                                                                                                                                                                                                                                                Entropy (8bit):4.917182390229381
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/we7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wI8RQy
                                                                                                                                                                                                                                                MD5:3327B1BF3118AC6AFC02C31DF5B67CD9
                                                                                                                                                                                                                                                SHA1:3932577E66801AD31519B0BB56CCE7B9E36221A9
                                                                                                                                                                                                                                                SHA-256:BE48462CCFBB3AEE19597F082A17C2C5D2FD8BB1C9122245EFAB0A51F8F413B0
                                                                                                                                                                                                                                                SHA-512:53866FD513B039E8203E51FF3434D5736D3A4C4E0A46874D1C99A17115181AF749F0D079C2E14C5B0538D3DFA52B1645C977CD6599DA3EDA57CC7F84EEAB2D06
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT+0) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\GMT-0

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):155
                                                                                                                                                                                                                                                Entropy (8bit):4.904279164422928
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/w4Hp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/w4J8RQy
                                                                                                                                                                                                                                                MD5:0CFFC5655F031D954BD623CC4C74DC9C
                                                                                                                                                                                                                                                SHA1:CE5E7AD67252F52D7E70719725FF5BE393DD6EF0
                                                                                                                                                                                                                                                SHA-256:944C86F516141DDC3AEC1AE4A963E9769879C48ED12DADDF4ED63A01313ACD00
                                                                                                                                                                                                                                                SHA-512:C7352D1394E8B8AC90CD19EE753D5277259BE5512ADDCAED2A2DEF144762CF20BE7A9FA09AAA1829EE401DD195C2AED8C967A7FF46739236E042AF4298EC84A2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT-0) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\GMT0

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):154
                                                                                                                                                                                                                                                Entropy (8bit):4.892526720357546
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wPHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wvp8RQy
                                                                                                                                                                                                                                                MD5:565B41A5DB28F9FE7D220E9BA39062A4
                                                                                                                                                                                                                                                SHA1:5183689210F07C8A71F880DCE8E5C2CB62CEB17D
                                                                                                                                                                                                                                                SHA-256:54850A5F488205DB01FBB46E2DA9FFF951C4571029EA64D35932DDEA5346DAAF
                                                                                                                                                                                                                                                SHA-512:BD6E5141F06B03D62DCF725E9E48D6AA8ECD6E8E47A4015B25DC3F672392065FFFD80D688C6695324DC105EA528025CF447FA77E6D17E15D438E61DC51879CB7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT0) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Greenwich

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):159
                                                                                                                                                                                                                                                Entropy (8bit):4.917976058206477
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wE+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/wE6BURQy
                                                                                                                                                                                                                                                MD5:443FA76F107ED438F9571A044B848C6A
                                                                                                                                                                                                                                                SHA1:1CF508429DFC40643B1FAB336A249A3A287D8C7C
                                                                                                                                                                                                                                                SHA-256:9E7A8DAA26CE36E8F7D7F13460915C063EE98E2A4DB276AD9D15CA5C7C06815F
                                                                                                                                                                                                                                                SHA-512:6C0C5FF513A742FBDA349AC3A2581D456701B5348A54ECF38E496DAA1EFC74D937982B6F69F1761CC2FC4B88D9A971EFA2B16096E71EAF002EC5CE4130B533DE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Greenwich) $TZData(:Etc/GMT)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\HST

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):111
                                                                                                                                                                                                                                                Entropy (8bit):4.90682088010982
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x//LhdNMXGm2OH1V90v:SlSWB9eg/jJDm2OH1VGv
                                                                                                                                                                                                                                                MD5:79C82A5F8B034E71D0582371E3218DBB
                                                                                                                                                                                                                                                SHA1:1476CE8EA223095094B6D25D171E6319C96669F4
                                                                                                                                                                                                                                                SHA-256:8D710699AF319E0DDB83E9F3A32D07AE8082EA2F7EABBD345EFFFFB0F563062E
                                                                                                                                                                                                                                                SHA-512:ADEE55581D1A158929F09A63B03883ABE9193337DDF225C61AFDBB8A2C7D0BD248ADC4714E0EEFD334826C54C1AFFC8B1E6C2B0D6EF830C3CCA50CC79834F473
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:HST) {.. {-9223372036854775808 -36000 0 HST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Hongkong

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.913328649996328
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8Li0vXHAIgN2qfvRL//XF1p4WFKQyvn:SlSWB9vsM3yW2HAIgAOvN///p4wKlvn
                                                                                                                                                                                                                                                MD5:6A307B229C302B1BAE783C8143809269
                                                                                                                                                                                                                                                SHA1:EA169AF81AD12380A69FB6B7A12479BA8B82878B
                                                                                                                                                                                                                                                SHA-256:359C9C02A9FA3DE10BA48FA0AB47D8D7AFF3B47F950CFAF5EB68F842EA52AB21
                                                                                                                                                                                                                                                SHA-512:505445FD0B3E140384EDC27993923BBF9ACD23A244B0F14D58804BFAA946D0BC4C0D301FBCCB492BAFDA42C8A92F4163FB96F4D75DD7374858D1C66183BEC24B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Hong_Kong)]} {.. LoadTimeZoneFile Asia/Hong_Kong..}..set TZData(:Hongkong) $TZData(:Asia/Hong_Kong)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Iceland

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):178
                                                                                                                                                                                                                                                Entropy (8bit):4.853280551555672
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/+GAKyx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/+XZx+D4
                                                                                                                                                                                                                                                MD5:710D3A32EA8EAD11B45D4911DA8F2676
                                                                                                                                                                                                                                                SHA1:146D2A6D48940E58567EFA3BCA134D195E4649E6
                                                                                                                                                                                                                                                SHA-256:8A531293F672D8FE38996989FC4EEB22B5EFE6E046E2F58E94D01DA9CE56EF68
                                                                                                                                                                                                                                                SHA-512:70432973549C1A83036E0658AEE81C883F19D0D631E35F4C70F2EC69C9384E99340004618EF8B414D8EA9090C6C3120CF46A5D9ABDE4113917995B2844337988
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Iceland) $TZData(:Africa/Abidjan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Antananarivo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.807410166086502
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL/liEi2eDcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LzM2eV
                                                                                                                                                                                                                                                MD5:0F20CBF1F7600D05F85D4D90FDAB2465
                                                                                                                                                                                                                                                SHA1:2F3C9479C4F4CD7999B19C07359B89A5FB1B9839
                                                                                                                                                                                                                                                SHA-256:1B1177CE4D59D7CBCAE9B0421EB00AD341ECB299BD15773D4ED077F0F2CE7B38
                                                                                                                                                                                                                                                SHA-512:657341FC2CCD6A4F7B405ABC8E24C651F6FFEFD68EBD6E2086ADF44834DCBF21D1B9D414436E42C8DCE46FFB88116B98C1D073782E214B3996D49EC00DFF4383
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Antananarivo) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Chagos

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.853088038233057
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL9WJx3vFNMXGm2OHi/FvoHscfJ7XH0VQVFV6VVFSTVV:SlSWB9eg/+LxWJxPDm2OHqFvoH9+VQV3
                                                                                                                                                                                                                                                MD5:06143C3DFD86B3FE4F2A3060C0E05BB6
                                                                                                                                                                                                                                                SHA1:88E0E30CEE4AB8117860A35AD03B16AF48988789
                                                                                                                                                                                                                                                SHA-256:11044AD7CB0848CC734D2A67128AA6AC07CB89268399AA0A71A99024DE4B8879
                                                                                                                                                                                                                                                SHA-512:79195D3D0D475BEA982F40683D4BA14AC33B3FA91311F513DCED955C9297C2B0F12D94CCA930FAE0FB7F95DB34CD4E74B5AF0233E792122646592B7EFF0F3163
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Chagos) {.. {-9223372036854775808 17380 0 LMT}.. {-1988167780 18000 0 +05}.. {820436400 21600 0 +06}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Christmas

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.910217468889087
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/+L6EL9FBIEWoxp4Wx:SlSWB9vsM3y1LePHAIgKELtAN/+LxpWg
                                                                                                                                                                                                                                                MD5:39CB9E58C0086B80FB12AC10A6D371E2
                                                                                                                                                                                                                                                SHA1:2A9A5CCA411779615A62D9E82023B6A066CB3CF3
                                                                                                                                                                                                                                                SHA-256:78A208B73426A1B6D7CF2FE89A0EF3F01721F877D569BC43F2E5B6625A947299
                                                                                                                                                                                                                                                SHA-512:BB6C8CF2B6AF9F93A7F7382A453261FA43E6E42E9ED1223F25A70DAD2ABBBF2F5777288553F4BC0155944754655D2C3F81BD81E5B1F611C4B2CCDB729B67AAC5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Indian/Christmas) $TZData(:Asia/Bangkok)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Cocos

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):174
                                                                                                                                                                                                                                                Entropy (8bit):4.818886812441817
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8nv3vXHAIgNnDA6RL/+L6EL9dEh4WFKsyn:SlSWB9vsM3yHvPHAIg15N/+Lxah4wKsy
                                                                                                                                                                                                                                                MD5:9462E9CFC88C3DA3CCCDA18C92E49A97
                                                                                                                                                                                                                                                SHA1:B50C82C6C7361BD6F028F82E2FEAF8486D798137
                                                                                                                                                                                                                                                SHA-256:EB301EE97A9FDE8ACE0243941C0FAC9ED0E3ACFD6497ABE408F08E95FAE3B732
                                                                                                                                                                                                                                                SHA-512:A48EBDA0A93C3505BC6149863F4A7B1043F856A8EB516CF42C050A95E81CD152BC1C0313B3DD115D53DABA95413AF34902D7D11C984DE5A03FC5FFADAF8EA89F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Yangon)]} {.. LoadTimeZoneFile Asia/Yangon..}..set TZData(:Indian/Cocos) $TZData(:Asia/Yangon)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Comoro

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.825881690094318
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL9TKlBx+DcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LxGV+V
                                                                                                                                                                                                                                                MD5:7EBDFA311C7852AFADF880395071DE48
                                                                                                                                                                                                                                                SHA1:F6EC21FDFB75EC1BE45B1C4170147CBA3E870E7B
                                                                                                                                                                                                                                                SHA-256:53FA58E32DC2E4ABB574B2F78011815EEB7F89F453CC63C6B6C1460ABBB4CA5C
                                                                                                                                                                                                                                                SHA-512:DFBCD4EA4AFFA1D1CAE7308168874527FD36B5CAE76153AADA9C5E5F628258AB26654A16C8A5F8906FC5918398FD880B15B6DD4E3EF6AD3BE63D4A2455701FA8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Comoro) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Kerguelen

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.822075418239496
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqKGE4YF3vXHAIgnGED9HRL/+L6EL12h6hwL6ELzEov:SlSWB9vsM3ypGEVFPHAIgnGEtN/+L5Ry
                                                                                                                                                                                                                                                MD5:9AB222C67E079B55DDF3ACAE67BD0261
                                                                                                                                                                                                                                                SHA1:F9E6C34A00F9F1B152CEA729F087BD24993CA2E8
                                                                                                                                                                                                                                                SHA-256:138C7FFBFC520372658CA0CD1B42C4E5A240E9D9B98A277B02481DE5701222FC
                                                                                                                                                                                                                                                SHA-512:5F3EFF78506056F981DB0446436B39953D90265227890176D8287E2149B176B9DCCA14E795083B1EBC202D02AA88D584A9BB49868F30895EF17E92AA98ACB7C7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Indian/Maldives)]} {.. LoadTimeZoneFile Indian/Maldives..}..set TZData(:Indian/Kerguelen) $TZData(:Indian/Maldives)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Mahe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):170
                                                                                                                                                                                                                                                Entropy (8bit):4.84472938642971
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8DeXHAIgN6S7ARL/+L6ELzJM1h4WFKQ3n:SlSWB9vsM3yj+HAIgMS7AN/+L/Yh4wKC
                                                                                                                                                                                                                                                MD5:C866B2A879786B7D9341FA904FC7D01A
                                                                                                                                                                                                                                                SHA1:DAF7B405E6DAA0C88C6F3A26AAA172E38CE5CAF3
                                                                                                                                                                                                                                                SHA-256:613C5C05A8867E4B59A97A3D8C7235DDC0CA23239F2D57A5BFD42E4AB94FD510
                                                                                                                                                                                                                                                SHA-512:BB01A464366F1F93591F48C42F300421AF774E50E5B5232AB0C755482E3306EDDB54A9BCF6E9D325EAE63AAC6D3857F4D754FC28A34F90AC728B7158B61E2C57
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dubai)]} {.. LoadTimeZoneFile Asia/Dubai..}..set TZData(:Indian/Mahe) $TZData(:Asia/Dubai)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Maldives

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.883092265054605
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/+L6ELzE5FNMXGm2OHnz8eoHvZT5lxV/uUQwGN0VQVFv:SlSWB9eg/+L/EJDm2OHnz8eoHvZT5rdI
                                                                                                                                                                                                                                                MD5:4DF975C040D78FA8F9C92E5565D63A73
                                                                                                                                                                                                                                                SHA1:48488F076871530D32278084F1C9CB90CB1E6AB4
                                                                                                                                                                                                                                                SHA-256:9FAC69DC609CC6074ECD67E0BE8AE62E33D8D9C7F055A3E0DEE1430C7FFC54F6
                                                                                                                                                                                                                                                SHA-512:880B920FB51F48731BA8C741B9583038A3276221C55F1CE0B464D2797D71EF9D22B4E166841BAB0544B7091CE683697BFCA5A4235FF1E6264B0619DBDD4BB619
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Maldives) {.. {-9223372036854775808 17640 0 LMT}.. {-2840158440 17640 0 MMT}.. {-315636840 18000 0 +05}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Mauritius

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):272
                                                                                                                                                                                                                                                Entropy (8bit):4.5144164346164715
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/+L/GDm2OHlNnoH9SvulvSNFF+c0FSFFMVhvSNFFVBjvVFSFFVGlvSN:MB86+L/CmdHlNnCy6qB0FScZq9BjVFSL
                                                                                                                                                                                                                                                MD5:05362B6A17C5F4F4E8CBE5A676D5D0DE
                                                                                                                                                                                                                                                SHA1:84675D5E8D1425A5E9DB07D1BC1E6A5921B5AC91
                                                                                                                                                                                                                                                SHA-256:A2B1B93CBEECBD900ED71E61A4932509EB52688E97A6015DAD067066D0D42072
                                                                                                                                                                                                                                                SHA-512:351D2BC5F5888D8E842BF160D11D57E059811186D63B0413061768C7FE348CECB700748A0C0125F0ABCBB039FC74FF7BEEFDD42088BA1E28C785E545ED2CDF24
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Mauritius) {.. {-9223372036854775808 13800 0 LMT}.. {-1988164200 14400 0 +04}.. {403041600 18000 1 +04}.. {417034800 14400 0 +04}.. {1224972000 18000 1 +04}.. {1238274000 14400 0 +04}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Mayotte

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.828945679595274
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6ELzO1h4DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/+L/O1hm
                                                                                                                                                                                                                                                MD5:8ABBEC0E138C1A68CB5D096E822DE75E
                                                                                                                                                                                                                                                SHA1:E9C5CE1A249F6DC0F6EDBB3F5B00F3106E3BD6CA
                                                                                                                                                                                                                                                SHA-256:845C45FD7B6F0604B03A3C72DB117878B568FB537BCA078304727964157B96AB
                                                                                                                                                                                                                                                SHA-512:15790CCA70140D3139F3E2A202DC8F12E68466A367C68458D6A78CDDC7822FB5EDB87D630926B51F3DE48D95DE7CA3FCB946CD7B762FE5B15866DAA9DBA40B46
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Mayotte) $TZData(:Africa/Nairobi)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Indian\Reunion

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):173
                                                                                                                                                                                                                                                Entropy (8bit):4.825214661273383
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8DeXHAIgN6S7ARL/+L6ELsAceh4WFKQ3n:SlSWB9vsM3yj+HAIgMS7AN/+Lj4wKQ3
                                                                                                                                                                                                                                                MD5:7B22FE05231A5721C939B6018F8A2814
                                                                                                                                                                                                                                                SHA1:E272C25E79ABE705B2DB106D70DEAB3245EA9D35
                                                                                                                                                                                                                                                SHA-256:5560B0D4A2D8A13D9FE9787FFFE31200D405A8C875F046C8FDDF850AF98662B6
                                                                                                                                                                                                                                                SHA-512:26244855D029151B84A4D57E2FA69632B4F19F8C00B2E500A394D76A29857BE2A412344794BA0DFF50A2863FF17889210A151D0E231A67E55091F4909EC4AE79
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dubai)]} {.. LoadTimeZoneFile Asia/Dubai..}..set TZData(:Indian/Reunion) $TZData(:Asia/Dubai)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Iran

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):166
                                                                                                                                                                                                                                                Entropy (8bit):4.809541513808179
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8g5YFeovXHAIgNqjyVHRL/+XiMr4WFKBpv:SlSWB9vsM3yA5oPHAIgcjeHN/+Xvr4wY
                                                                                                                                                                                                                                                MD5:A90C26358FEF60E49044E3BE02866FAC
                                                                                                                                                                                                                                                SHA1:137AC8CCA23F39E7A16C4050EA9A3A8731E9AAD7
                                                                                                                                                                                                                                                SHA-256:FE7F4453CB5F6B81B23C1C795356B91FE319F0762BE7868FAFE361DB1F9C2A2B
                                                                                                                                                                                                                                                SHA-512:D6C74CACF69D29E14CB46E5DD885234AC50EE2E258E0C5E3AC76465061622F064F974D33E91A6A020B9D618D90799DDA6EB1EA53022EDB6E26A9CB6ADFE0AA30
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tehran)]} {.. LoadTimeZoneFile Asia/Tehran..}..set TZData(:Iran) $TZData(:Asia/Tehran)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Israel

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):177
                                                                                                                                                                                                                                                Entropy (8bit):4.8290104377288925
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/+WXnMr4WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/+zr4wKY+
                                                                                                                                                                                                                                                MD5:6BCC43951637D86ED54585BE0819E39C
                                                                                                                                                                                                                                                SHA1:6F04F306B3AB2A6419377294238B3164F86EF4A3
                                                                                                                                                                                                                                                SHA-256:805105F5F17B78929F8476BAE83ED972128633FF6F74B7748B063E3C810C27A6
                                                                                                                                                                                                                                                SHA-512:ABB9F4308BF4BD5C62C215A7ECD95042CBFB3005AF1E75F640962B022574C930DD5A12CD0CE0AF8A3D7E38B999E37C3A45A55091683F6A87E9D0CDA9EE417293
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Israel) $TZData(:Asia/Jerusalem)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Jamaica

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.722012123002917
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx00EIECWXHAIg200EIE/vHRL/9S//2IAcGE0EIESvn:SlSWB9vsM3y795VHAIgp95HN/029095c
                                                                                                                                                                                                                                                MD5:1F020341AD51AA82794B8018F214DE0D
                                                                                                                                                                                                                                                SHA1:4414E56C1277B4D31FE557F8652D522C0594F4B2
                                                                                                                                                                                                                                                SHA-256:F01B00D52BD7B2694BF5CB55A17028C30A41BD22A774CA54740E8B1DDE4FCB2E
                                                                                                                                                                                                                                                SHA-512:CC41848A851D4992AE9F27C38669CB87CE2FD05A33AB6989EA21AFCB1A2707DE0CB4D62BCC45E536DD944859991D7564847205F47509A42D41932370496A77D7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Jamaica)]} {.. LoadTimeZoneFile America/Jamaica..}..set TZData(:Jamaica) $TZData(:America/Jamaica)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Japan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):164
                                                                                                                                                                                                                                                Entropy (8bit):4.8422204749795545
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8aofXHAIgNqsRL/9hM7/4WFK9vn:SlSWB9vsM3ypPHAIgcsN/4r4wKNn
                                                                                                                                                                                                                                                MD5:9554A65BFFCFFCFB2C1588569BB4638E
                                                                                                                                                                                                                                                SHA1:B377ECB04586396D37093856AEF8BBDC93192F66
                                                                                                                                                                                                                                                SHA-256:98DBD07AE3B9251B9091F4D265336CE98BDFB492AF863C1F3FF25248A2CADF35
                                                                                                                                                                                                                                                SHA-512:E2E761B8B1995B68721BC714A546E0F45EEC025FAF81DE579FF0D73D37783D0E031B9E78BA2FAC6B097E3673C47AFB8761FBC58E42E33018FD44B77F2871E0C6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tokyo)]} {.. LoadTimeZoneFile Asia/Tokyo..}..set TZData(:Japan) $TZData(:Asia/Tokyo)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Kwajalein

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.810216093939366
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG1/EOM23vXHAIgObT1/EOMH6RL/8/FMKpUDH1/Ex:SlSWB9vsM3yc1EiPHAIgOb1E+N/8xMEx
                                                                                                                                                                                                                                                MD5:05C0C40F2AA456F580EAAFC4F7E49B56
                                                                                                                                                                                                                                                SHA1:5796A9122693B2D6010BC5E617A6091F46330B0C
                                                                                                                                                                                                                                                SHA-256:85E95363ACF468043CD5146927A97B2D9E3B141EDA0A7993DADA9382D1D6DD54
                                                                                                                                                                                                                                                SHA-512:2155F8E3EB73312F0AFD5CDDF4B19EBB67A15658101870C2CEDF96955470DBC7B30F34E143D9C14CBFA7A138F63324009581BD0B807AE295C68588CA0470D7AD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kwajalein)]} {.. LoadTimeZoneFile Pacific/Kwajalein..}..set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Libya

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.829980800076139
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsbKJqYkyXHAIgNGEnKJp0ARL/7beDcbKJ6v:SlSWB9vsM3y7JSHAIgNTxAN/PeDE
                                                                                                                                                                                                                                                MD5:4D44D88336212E162CCEFADE6321EDBC
                                                                                                                                                                                                                                                SHA1:B9EE7AFE26DC61AA9EA37EB99A3C10DD176E8063
                                                                                                                                                                                                                                                SHA-256:F776839C1999056E6A0D2ECFDF9054FC309454AFDFF8E8BC803F33EC423B7361
                                                                                                                                                                                                                                                SHA-512:FDDCBD194DE07B51DEBBDEF4FD96762EE3507117443FB9F7975FB56E0AE97B0D1F8657FE26B092021FB12B5A5D3EFFAB9E0A54B1C2AFCEC1029855442A0A95AB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Tripoli)]} {.. LoadTimeZoneFile Africa/Tripoli..}..set TZData(:Libya) $TZData(:Africa/Tripoli)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\MET

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7736
                                                                                                                                                                                                                                                Entropy (8bit):3.799706947156251
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:aJCP8D3pCS2JWk55EyqJNSPTub3NDOyFyJYVtLbTxdqs0xcQVq+O7JSAmwQZjltB:FSyWBSPTujlOyqc3JuzVNvTN
                                                                                                                                                                                                                                                MD5:02B993B4A6956014A2DB844E8A5498C0
                                                                                                                                                                                                                                                SHA1:378333547254AC43BEB4FA2CBC24B8DE241B3078
                                                                                                                                                                                                                                                SHA-256:DF45F5414F1636B1856C7534BB5F3D4387C32D56283A68BB47D8C48C1DDAD5BC
                                                                                                                                                                                                                                                SHA-512:CC3ABCC1FB5ABD10A685F140931DE38D6875142D3595F8D9A581F5B31A7F354FA4CCC9727B69F58E0D2F773EA0F76D9ACFDF7ACBAFC6BAA6E93A46EAE8F18672
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MET) {.. {-9223372036854775808 3600 0 MET}.. {-1693706400 7200 1 MEST}.. {-1680483600 3600 0 MET}.. {-1663455600 7200 1 MEST}.. {-1650150000 3600 0 MET}.. {-1632006000 7200 1 MEST}.. {-1618700400 3600 0 MET}.. {-938905200 7200 1 MEST}.. {-857257200 3600 0 MET}.. {-844556400 7200 1 MEST}.. {-828226800 3600 0 MET}.. {-812502000 7200 1 MEST}.. {-796777200 3600 0 MET}.. {-781052400 7200 1 MEST}.. {-766623600 3600 0 MET}.. {228877200 7200 1 MEST}.. {243997200 3600 0 MET}.. {260326800 7200 1 MEST}.. {276051600 3600 0 MET}.. {291776400 7200 1 MEST}.. {307501200 3600 0 MET}.. {323830800 7200 1 MEST}.. {338950800 3600 0 MET}.. {354675600 7200 1 MEST}.. {370400400 3600 0 MET}.. {386125200 7200 1 MEST}.. {401850000 3600 0 MET}.. {417574800 7200 1 MEST}.. {433299600 3600 0 MET}.. {449024400 7200 1 MEST}.. {465354000 3600 0 MET}.. {481078800 7200

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\MST

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):111
                                                                                                                                                                                                                                                Entropy (8bit):4.902637155364683
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/6xtNMXGm2OHrXV4foAov:SlSWB9eg/6lDm2OHrCAAov
                                                                                                                                                                                                                                                MD5:36119516E87814F3C219193069CD6A90
                                                                                                                                                                                                                                                SHA1:BDB25531B30E6FC454100F37177EC9D4A0FB4E39
                                                                                                                                                                                                                                                SHA-256:E57746D5DB479A8B30973F2BC16E2B8DFB6E2BFAECBFF0FB956F04526E4B935B
                                                                                                                                                                                                                                                SHA-512:2730C5DABA0B2CCFD32A799C48EE07351659F51B9C2B91DCD145675AF276F2D0B5AA51ACF7D283C0DC236D3AFA3A75E58EB9F970B1831A6E36F02139CAF6A655
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MST) {.. {-9223372036854775808 -25200 0 MST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\MST7MDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8505
                                                                                                                                                                                                                                                Entropy (8bit):3.8405400251137207
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:T1ktwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:TswDPlLv/PCenJzS6cy
                                                                                                                                                                                                                                                MD5:87B3BCD4A793BA383889ECFDB44C846E
                                                                                                                                                                                                                                                SHA1:3EA34B5E6E3078A9501653BA069D5E5E879D7FE4
                                                                                                                                                                                                                                                SHA-256:A5DEB89D59613D9A54C1E146056A805B3DE9F2A2593AEC2B8A25F863328699C0
                                                                                                                                                                                                                                                SHA-512:AA4DAC2614661EF18A2A60A5BD4D5BBBCCB5D721F90A25E9D11C5B6AF8C39FD475B3E23894719E2F8F74469F13D5492FF31DDD193D9E3172182FBCBCDD860A41
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MST7MDT) {.. {-9223372036854775808 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1 MDT}.. {247046400 -25200 0 MST}.. {262774800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Mexico\BajaNorte

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.884776849010803
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/6AdMSKBbh4IAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/68K5h490m
                                                                                                                                                                                                                                                MD5:3050A0100A2313C1D3AB4278B464F17A
                                                                                                                                                                                                                                                SHA1:1A140447B3972900F13768659FD6979F68126E97
                                                                                                                                                                                                                                                SHA-256:F8CA38A845CD01BF785EE222277DAD9325AB6BD17E44A362C450855AEB522814
                                                                                                                                                                                                                                                SHA-512:C91C4BF2318C50D473E6051855C12F0E11CBAA8580B88115CDDE054D36476A1D8DDC5D17A7A123BD84148C20B96BD839511EAD573F5FD2C9A8556646B9CDE5E5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Mexico\BajaSur

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):191
                                                                                                                                                                                                                                                Entropy (8bit):4.8897674180962145
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0zjRJ+ovXHAIg20zjRJ8yHRL/6AdMPCoQIAcGEzjy:SlSWB9vsM3y7zjRJvHAIgpzjRJ8yHN/Z
                                                                                                                                                                                                                                                MD5:FAFD9727A0E153AFCB726690D215DA76
                                                                                                                                                                                                                                                SHA1:3CD3B2737FC781F38DE26E255968CBB88B773CBF
                                                                                                                                                                                                                                                SHA-256:2E6E32A40487F0146B59150B66FF74901CA853B12D47922819AF23EEA5B4149C
                                                                                                                                                                                                                                                SHA-512:76D110494D4EB76961C818B2A2CCB2303B31DA161664FA712C87B95B81DE7B8F3E50DC7B2836C6ECC6437AE9595668E62E4E706F1B343EFEA12C32210F113540
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mazatlan)]} {.. LoadTimeZoneFile America/Mazatlan..}..set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Mexico\General

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):200
                                                                                                                                                                                                                                                Entropy (8bit):4.877941255622543
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y7zBDSHAIgpzBx6N/6BXl490zBf:MByMYzppzH6t6Bi90z1
                                                                                                                                                                                                                                                MD5:29ACBFCD0FD521EC0C9523906B9E2252
                                                                                                                                                                                                                                                SHA1:BBC1AD3F78CAA634A2F0BC38059975EF8E4A2CE9
                                                                                                                                                                                                                                                SHA-256:2DFF1B83FECFAD5C27EC47B206696C29B91398F8185B5D406A66FA9E0AECA93F
                                                                                                                                                                                                                                                SHA-512:802502010CFB6F1F4E60C22ECB0E6CA22750975E5838BE7E7DC9D12EA019CB6508F0F87465A113A98356CC9E145E32E6633AE2B45B93412A358C4AD13E923EFE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mexico_City)]} {.. LoadTimeZoneFile America/Mexico_City..}..set TZData(:Mexico/General) $TZData(:America/Mexico_City)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\NZ

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.888611285267583
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG/u4WXHAIgObT/KvRRL/5E1nUDH/uov:SlSWB9vsM3ycqXHAIgObOvRN/iy
                                                                                                                                                                                                                                                MD5:92548E239012515D756E002768CA876A
                                                                                                                                                                                                                                                SHA1:6BDC73DBD7356C3F82C5C76E6E2D58656FA9E21D
                                                                                                                                                                                                                                                SHA-256:E22D629D53C54960AD156C377DE0AE461C27F554990A3D1305724CA8F869BCE4
                                                                                                                                                                                                                                                SHA-512:42AD074EE08E083EE91270F203707698A8B3308005C94514B8B2D950F4C6F0B37D7D32973EC9F6AB49A0875209076FB40341B31433A27E47B3CC0EA711ECE321
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:NZ) $TZData(:Pacific/Auckland)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\NZ-CHAT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                                Entropy (8bit):4.881663364410736
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG9WQ+DyXHAIgObT9WQiovRL/5AmtBFB/pUDH9WQg:SlSWB9vsM3ycwQ+DSHAIgObwQTN/zzJ7
                                                                                                                                                                                                                                                MD5:3811C133C6311E33FDAF93660E1EAED5
                                                                                                                                                                                                                                                SHA1:64756FF877B2EB91BAED2889B3924DAB6784DF43
                                                                                                                                                                                                                                                SHA-256:83F4CA3522B64F9B151EDEFAE53E0F28C2E6C4CE16D0982186B3344F2A268724
                                                                                                                                                                                                                                                SHA-512:7724D6CD08E13E116CCDF073F86CE317C0D4A849C5FE81DF3127D435704507FBF554BFC6E7A50CCA3852F6001D8654B7FF90466878DB8C3298338BE16149FD32
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chatham)]} {.. LoadTimeZoneFile Pacific/Chatham..}..set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Navajo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):177
                                                                                                                                                                                                                                                Entropy (8bit):4.8545620422964015
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/5vf1+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/pd+90+B
                                                                                                                                                                                                                                                MD5:5E9F3294F68873BF503F3DDDDF6713B0
                                                                                                                                                                                                                                                SHA1:954CD6F123C043E64F5E49733327E2C78877BDFB
                                                                                                                                                                                                                                                SHA-256:2CC8CE235F2EE3160E6AFD04A4E28AA0312494EBB6FED08D8CC81D414EC540EE
                                                                                                                                                                                                                                                SHA-512:200FC489989CA57219D5B28FB135BE5BDAC67239F3D243C496545D86D68089E51856CEAC4D2E700C0E47BAE4D5FEAB18A367C554235615B2B860F4E5E1BB08C3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:Navajo) $TZData(:America/Denver)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\PRC

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):171
                                                                                                                                                                                                                                                Entropy (8bit):4.902914099699953
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/nL75h4WFKdy:SlSWB9vsM3yMPHAIgO8AN/H5h4wKU
                                                                                                                                                                                                                                                MD5:87C439DC623BF5C7EB01ADA6E67FB63A
                                                                                                                                                                                                                                                SHA1:1CC357558E09CDEA49F821826D2AEA9A6EF2C824
                                                                                                                                                                                                                                                SHA-256:6A5BAA9CA54B2A2C6D21287443BE0B1064AA79B5C4C62939933F8A0AD842B73E
                                                                                                                                                                                                                                                SHA-512:E628B8F1C967AABAEFBB68A33416F6FE47422970BA18414BB3396AC063E65A4DC892595D4071395194AF320633EE915A494E1F8D4216EE8194A034739D275C49
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:PRC) $TZData(:Asia/Shanghai)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\PST8PDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8505
                                                                                                                                                                                                                                                Entropy (8bit):3.836877329152454
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:0KhTG0hjvZkR/bvtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:0sG0U9bFzN6IkWq/WHQt/RY4yP
                                                                                                                                                                                                                                                MD5:45E7E9E183A990F56E17C04FA48CE620
                                                                                                                                                                                                                                                SHA1:A1F39E0ECEA3C64E761A9A3159E331FA51B625F9
                                                                                                                                                                                                                                                SHA-256:D148708F1E70EEFA51E88E5823776CBE710535D4D6D6356E7753A44463A1C5AB
                                                                                                                                                                                                                                                SHA-512:1D1F4BA90D07D7EE12DFD0E37DBFD5410A4EAFFBA8960B816FDD5963CD6B20938080A4248E7B249AAE02F068E817AB9A85735D226F7DA8DD2C5462A70B18E8EF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:PST8PDT) {.. {-9223372036854775808 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-84376800 -25200 1 PDT}.. {-68655600 -28800 0 PST}.. {-52927200 -25200 1 PDT}.. {-37206000 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Apia

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):909
                                                                                                                                                                                                                                                Entropy (8bit):4.042826306713664
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86HbmdH2oVCvcCfdf3NaDyTb6Dye78ubUt1NEUtszIVbUtoUtoUt3mbUt4qUt6:Yekv5fcfem+Cuy
                                                                                                                                                                                                                                                MD5:E5B913965F72AB807BAE67BD20C0A699
                                                                                                                                                                                                                                                SHA1:2161B73EC868C8D18C09970766D19A8583FF7981
                                                                                                                                                                                                                                                SHA-256:983884249ACC11C3FE740D78E72B1A89BE9C8B077283549BF6BCD8C93FA71731
                                                                                                                                                                                                                                                SHA-512:F8807C52DB852C48C62F25569C990C31D977BC7D0DF502CF2B92F9ED6BCB89A6DD8A6758FBD1185E0B5C34DE5450D5C748B71760AC93E72DC3976B3B31D1A605
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Apia) {.. {-9223372036854775808 45184 0 LMT}.. {-2445424384 -41216 0 LMT}.. {-1861878784 -41400 0 -1130}.. {-631110600 -39600 0 -11}.. {1285498800 -36000 1 -11}.. {1301752800 -39600 0 -11}.. {1316872800 -36000 1 -11}.. {1325239200 50400 0 +13}.. {1333202400 46800 0 +13}.. {1348927200 50400 1 +13}.. {1365256800 46800 0 +13}.. {1380376800 50400 1 +13}.. {1396706400 46800 0 +13}.. {1411826400 50400 1 +13}.. {1428156000 46800 0 +13}.. {1443276000 50400 1 +13}.. {1459605600 46800 0 +13}.. {1474725600 50400 1 +13}.. {1491055200 46800 0 +13}.. {1506175200 50400 1 +13}.. {1522504800 46800 0 +13}.. {1538229600 50400 1 +13}.. {1554559200 46800 0 +13}.. {1569679200 50400 1 +13}.. {1586008800 46800 0 +13}.. {1601128800 50400 1 +13}.. {1617458400 46800 0 +13}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Auckland

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8772
                                                                                                                                                                                                                                                Entropy (8bit):3.900078030355782
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:pj4hKuZaqaaiFKgjGeGV3atL67G9kJGsU+mpe7Vy:Cla1KgjGeGcQMsa
                                                                                                                                                                                                                                                MD5:8174D7205622711F58E0B515246FE89D
                                                                                                                                                                                                                                                SHA1:9777B2633ACF5588268D5072F817E65C879358AC
                                                                                                                                                                                                                                                SHA-256:201CFADB00FBCD3283249DAD73872ED75C5BEC07F5A5B157726638C20728B833
                                                                                                                                                                                                                                                SHA-512:64121ED1EE70D5423710319E806B19261576AECC89A64CBEC44A29BF4AC9FEE21C6484CC3C4550CC92C315B3855BE265F696F8CD4D95027226D608B3ADD022F1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Auckland) {.. {-9223372036854775808 41944 0 LMT}.. {-3192435544 41400 0 NZMT}.. {-1330335000 45000 1 NZST}.. {-1320057000 41400 0 NZMT}.. {-1300699800 43200 1 NZST}.. {-1287396000 41400 0 NZMT}.. {-1269250200 43200 1 NZST}.. {-1255946400 41400 0 NZMT}.. {-1237800600 43200 1 NZST}.. {-1224496800 41400 0 NZMT}.. {-1206351000 43200 1 NZST}.. {-1192442400 41400 0 NZMT}.. {-1174901400 43200 1 NZST}.. {-1160992800 41400 0 NZMT}.. {-1143451800 43200 1 NZST}.. {-1125914400 41400 0 NZMT}.. {-1112607000 43200 1 NZST}.. {-1094464800 41400 0 NZMT}.. {-1081157400 43200 1 NZST}.. {-1063015200 41400 0 NZMT}.. {-1049707800 43200 1 NZST}.. {-1031565600 41400 0 NZMT}.. {-1018258200 43200 1 NZST}.. {-1000116000 41400 0 NZMT}.. {-986808600 43200 1 NZST}.. {-968061600 41400 0 NZMT}.. {-955359000 43200 1 NZST}.. {-936612000 41400 0 NZMT}.. {-923304600 4320

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Bougainville

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):280
                                                                                                                                                                                                                                                Entropy (8bit):4.715653436088026
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/FtTfDm2OHHhp5oHvZiuo2HvDVeEU8vScH9syZEizy:MB86FtTLmdHf5CvZiIvJeJ8HH9F6izy
                                                                                                                                                                                                                                                MD5:4E858B3754BD8864719A61839ACA64E6
                                                                                                                                                                                                                                                SHA1:597025A8DAFD5AE75EBD162AC0E9DA71815816BA
                                                                                                                                                                                                                                                SHA-256:2D3BFDED297214BA25CFD8C6F508D0C8B1A1CD7D46701A78EC5E510076185EB6
                                                                                                                                                                                                                                                SHA-512:720F301B73C852EA8EEFA79DEF6B6762554E50222DE114FE87EB5178507F1895A9A39B3872A1A4B9DFF58D1CC6460BA4A82F2C165E3659E13036451F22E389C3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Bougainville) {.. {-9223372036854775808 37336 0 LMT}.. {-2840178136 35312 0 PMMT}.. {-2366790512 36000 0 +10}.. {-868010400 32400 0 +09}.. {-768906000 36000 0 +10}.. {1419696000 39600 0 +11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Chatham

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8165
                                                                                                                                                                                                                                                Entropy (8bit):3.6566720439018874
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:gpvlGCcn6AadFurBrioCdL49mq9X4a2t3I/KVE:gOCBdFurBr0soaz
                                                                                                                                                                                                                                                MD5:8105A806A1762932897AB59C47BBE89E
                                                                                                                                                                                                                                                SHA1:386E41A4A83FA84DBFCA994F679242D067CEED64
                                                                                                                                                                                                                                                SHA-256:CA0EEF84DBC5964EF2265E9252237BE58BB8D75C34817CC2305CCCFAEC7E690C
                                                                                                                                                                                                                                                SHA-512:8A609E7F4868BD455DA811E62142FECD792D0CA0DAAF7C10C4E4254C9EC44B8EB92D388D9224C8FD3CC3FB326A106D831B80F5E1264CCF3EABBCE177BB82E9D6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Chatham) {.. {-9223372036854775808 44028 0 LMT}.. {-3192437628 44100 0 +1215}.. {-757426500 45900 0 +1245}.. {152632800 49500 1 +1245}.. {162309600 45900 0 +1245}.. {183477600 49500 1 +1245}.. {194968800 45900 0 +1245}.. {215532000 49500 1 +1245}.. {226418400 45900 0 +1245}.. {246981600 49500 1 +1245}.. {257868000 45900 0 +1245}.. {278431200 49500 1 +1245}.. {289317600 45900 0 +1245}.. {309880800 49500 1 +1245}.. {320767200 45900 0 +1245}.. {341330400 49500 1 +1245}.. {352216800 45900 0 +1245}.. {372780000 49500 1 +1245}.. {384271200 45900 0 +1245}.. {404834400 49500 1 +1245}.. {415720800 45900 0 +1245}.. {436284000 49500 1 +1245}.. {447170400 45900 0 +1245}.. {467733600 49500 1 +1245}.. {478620000 45900 0 +1245}.. {499183200 49500 1 +1245}.. {510069600 45900 0 +1245}.. {530632800 49500 1 +1245}.. {541519200 45900 0 +1245}.. {56208

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Chuuk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):202
                                                                                                                                                                                                                                                Entropy (8bit):4.943709180393636
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yci/452HAIgObi/4oA6N/ZE/4pv:MByMdNXiU5tVv
                                                                                                                                                                                                                                                MD5:7D9980F68F044EB9B7FA7ED2883645F2
                                                                                                                                                                                                                                                SHA1:9444DA9D3139F51C6DFDA174C8C52A231215D71E
                                                                                                                                                                                                                                                SHA-256:F324CA637180F50DB79FFA25204D974C6A7A6FAEFDA69FD1A280B9F366349A09
                                                                                                                                                                                                                                                SHA-512:850577ABD3A3653076797D46AF481343CDF8103AC597EB68F575C5FF4931242C6ACEB054D14E0F6A9A90E5D22069F78027215A4E44FC900292445FDEAFB8F92D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Pacific/Chuuk) $TZData(:Pacific/Port_Moresby)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Easter

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8203
                                                                                                                                                                                                                                                Entropy (8bit):3.5469404823178463
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:QXn3AWkHkPp2YXaVU+POtUn4n6MSmSmiTpk9eL6Z5waKkhWILTc:QXn3AWJB2m+POtUnOSmSmS6ZaILg
                                                                                                                                                                                                                                                MD5:002F3607DE2061A2E1A8EB8EBCB6E492
                                                                                                                                                                                                                                                SHA1:6521B47847CFA76FE45AE5CC649109E4AD6C5262
                                                                                                                                                                                                                                                SHA-256:D79A2A67606F25D6420F31129FAE966A54287DE96C661003CCE5F82B618014BC
                                                                                                                                                                                                                                                SHA-512:03F3F262538FAF5A1B38832EFA62E3CC41A70BF54E73DE59BC99DCCA035AB002142F42BEDA5BFC2102CD556601E0A278908FDCC838A2211AC63C49A8483CE72B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Easter) {.. {-9223372036854775808 -26248 0 LMT}.. {-2524495352 -26248 0 EMT}.. {-1178124152 -25200 0 -07}.. {-36619200 -21600 1 -07}.. {-23922000 -25200 0 -07}.. {-3355200 -21600 1 -07}.. {7527600 -25200 0 -07}.. {24465600 -21600 1 -07}.. {37767600 -25200 0 -07}.. {55915200 -21600 1 -07}.. {69217200 -25200 0 -07}.. {87969600 -21600 1 -07}.. {100666800 -25200 0 -07}.. {118209600 -21600 1 -07}.. {132116400 -25200 0 -07}.. {150868800 -21600 1 -07}.. {163566000 -25200 0 -07}.. {182318400 -21600 1 -07}.. {195620400 -25200 0 -07}.. {213768000 -21600 1 -07}.. {227070000 -25200 0 -07}.. {245217600 -21600 1 -07}.. {258519600 -25200 0 -07}.. {277272000 -21600 1 -07}.. {289969200 -25200 0 -07}.. {308721600 -21600 1 -07}.. {321418800 -25200 0 -07}.. {340171200 -21600 1 -07}.. {353473200 -25200 0 -07}.. {371620800 -21600 1 -07}.. {384922800

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Efate

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):789
                                                                                                                                                                                                                                                Entropy (8bit):4.0457106900970325
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86HmdH6mvCON3Xj/kw2eX/xtDedjX24ots0FX2ud5KRGkpFxy:uegazZBzCdXUFQzy
                                                                                                                                                                                                                                                MD5:6841B8A2FB9BBF464AA00088CBDCEC80
                                                                                                                                                                                                                                                SHA1:26CC5CCE00A765F8B6493ED24F50957AA7F0089B
                                                                                                                                                                                                                                                SHA-256:332372E5EFB46123FBB66F9F32F91B59EBD88ADB956249DB3F14CAAB01CE2655
                                                                                                                                                                                                                                                SHA-512:A6C67A0F7361E599369597E9A8A52FC7D5C96DE6B5A7C1BE1D02F5DF11051F448289786C7F0E82E71CDEB825215E64E072CF034C45D6E2F822D7201AB8B41B57
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Efate) {.. {-9223372036854775808 40396 0 LMT}.. {-1829387596 39600 0 +11}.. {125409600 43200 1 +11}.. {133876800 39600 0 +11}.. {433256400 43200 1 +11}.. {448977600 39600 0 +11}.. {464706000 43200 1 +11}.. {480427200 39600 0 +11}.. {496760400 43200 1 +11}.. {511876800 39600 0 +11}.. {528210000 43200 1 +11}.. {543931200 39600 0 +11}.. {559659600 43200 1 +11}.. {575380800 39600 0 +11}.. {591109200 43200 1 +11}.. {606830400 39600 0 +11}.. {622558800 43200 1 +11}.. {638280000 39600 0 +11}.. {654008400 43200 1 +11}.. {669729600 39600 0 +11}.. {686062800 43200 1 +11}.. {696340800 39600 0 +11}.. {719931600 43200 1 +11}.. {727790400 39600 0 +11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Enderbury

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.82787610497142
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG11avXHAIgObT11ORL/nUDH7/UDH11B:SlSWB9vsM3yckHAIgObON/h
                                                                                                                                                                                                                                                MD5:CD1AC50AADC3CF9C0E7A055D587E790D
                                                                                                                                                                                                                                                SHA1:BEE0E16D3954DF33C697DEA469A130BD9875AB8B
                                                                                                                                                                                                                                                SHA-256:790E6B48B261D6DEF7D183CC8F38FB8D8A6E3EFB8844281EFABB2DFD621E53B5
                                                                                                                                                                                                                                                SHA-512:B6A93DFB4CBE2F35268AACA88FDCC4D19949A2E8DC9464D8341C38065C6FF48A3C49FE756FFCE777C8F806DE309C8AFC4CE4BC4ABD183C28808F995A0F89B091
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kanton)]} {.. LoadTimeZoneFile Pacific/Kanton..}..set TZData(:Pacific/Enderbury) $TZData(:Pacific/Kanton)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Fakaofo

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.913439535905759
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDH4ErKYofMXGm2OH18VkeoHvmUENBBy/aCPFVFv7Dy:SlSWB9eg/BE3ofDm2OH1VeoHvmH7y/Fy
                                                                                                                                                                                                                                                MD5:6250F332356787613A2D1853EF6D1AC3
                                                                                                                                                                                                                                                SHA1:0464B9EE8B691990022295D2DEFE1AAE4B247E63
                                                                                                                                                                                                                                                SHA-256:336058DCA4802C79ED43F6177ADB73085D4FA0754B94051CAE2A19346B0C4904
                                                                                                                                                                                                                                                SHA-512:B8FAB5E128D2EF3CB7050DA717D80247045BE09F7F6542AA154CB85F4A56884F195EE2776421890A3F86D133106DCA4672D7D9329E0DE6F4A7CF8F4030822988
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fakaofo) {.. {-9223372036854775808 -41096 0 LMT}.. {-2177411704 -39600 0 -11}.. {1325242800 46800 0 +13}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Fiji

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):986
                                                                                                                                                                                                                                                Entropy (8bit):3.950865906618592
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:CKeaEa+TkUqOL1X7dMUhSXUmxY8yiUKEMH0Mkxu:9pW15Mmk59NQMk0
                                                                                                                                                                                                                                                MD5:E329ACBF859B35950B27F434D725B3F8
                                                                                                                                                                                                                                                SHA1:9B46C4318CA0F03E016F8FF68FEE50EA93B22360
                                                                                                                                                                                                                                                SHA-256:0FF7AF55C92806751473CBF7A55E860850719BA7255CD65FD630B99E05C7C177
                                                                                                                                                                                                                                                SHA-512:84A7491E2C8A6866B40A3673C084ABF3F1E344CB0290C607A0BB06FF19D43EF0B9648CDA6489D10C410D39C700D8C62A8BA11EEF07AD36F5A9AD85C596205939
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fiji) {.. {-9223372036854775808 42944 0 LMT}.. {-1709985344 43200 0 +12}.. {909842400 46800 1 +12}.. {920124000 43200 0 +12}.. {941896800 46800 1 +12}.. {951573600 43200 0 +12}.. {1259416800 46800 1 +12}.. {1269698400 43200 0 +12}.. {1287842400 46800 1 +12}.. {1299333600 43200 0 +12}.. {1319292000 46800 1 +12}.. {1327154400 43200 0 +12}.. {1350741600 46800 1 +12}.. {1358604000 43200 0 +12}.. {1382796000 46800 1 +12}.. {1390050000 43200 0 +12}.. {1414850400 46800 1 +12}.. {1421503200 43200 0 +12}.. {1446300000 46800 1 +12}.. {1452952800 43200 0 +12}.. {1478354400 46800 1 +12}.. {1484402400 43200 0 +12}.. {1509804000 46800 1 +12}.. {1515852000 43200 0 +12}.. {1541253600 46800 1 +12}.. {1547301600 43200 0 +12}.. {1573308000 46800 1 +12}.. {1578751200 43200 0 +12}.. {1608386400 46800 1 +12}.. {1610805600 43200 0 +12}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Funafuti

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):4.770127787944403
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGqhyXHAIgObTq0vFvRL/nUDH4QwyFPUDHqNn:SlSWB9vsM3ycmhSHAIgObmSN/BCLNn
                                                                                                                                                                                                                                                MD5:BBB00369FA8DCC23A7824EDB964BF48D
                                                                                                                                                                                                                                                SHA1:A97E42B3CC45860CC0DFC62F468B24A628B43973
                                                                                                                                                                                                                                                SHA-256:AFFB0A5D9CBD5949F2FC5047820FA2A2798F7C303F7BC972EC49CCF27837B00E
                                                                                                                                                                                                                                                SHA-512:2D4C8616308522C987437C39C74E250973C2AC7AA1499C60321F42E84CE52C28D1F6AE81E6390B116C92C7B208EA0F211EB3C5A86E6E4CEE0620014DE5359F4F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Tarawa)]} {.. LoadTimeZoneFile Pacific/Tarawa..}..set TZData(:Pacific/Funafuti) $TZData(:Pacific/Tarawa)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Galapagos

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):247
                                                                                                                                                                                                                                                Entropy (8bit):4.687336389955113
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/fEGDm2OHvQYeoHTie7KVQRncRvinrN5/uFifriX:MB86fhmdH0CTV7OcdrN5/uFiGX
                                                                                                                                                                                                                                                MD5:0557D164DCD8DF5D99F7AF5A2AB1AD4F
                                                                                                                                                                                                                                                SHA1:68AFD04303E5F541480425405D82E1827F78A8DF
                                                                                                                                                                                                                                                SHA-256:192545659F971084ADC8489A2B96A6439FF391599DC962AA13375ACCFB3C09D9
                                                                                                                                                                                                                                                SHA-512:1DA004E51F8E7A712EDE920CBB62E81F9F55450FB52B62F78F1CD4F8F4E342B4DAB2C28AA5161E8B24942A7A5BD55F978AFDA1C5E1949241E71D738079DEF9B8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Galapagos) {.. {-9223372036854775808 -21504 0 LMT}.. {-1230746496 -18000 0 -05}.. {504939600 -21600 0 -06}.. {722930400 -18000 1 -06}.. {728888400 -21600 0 -06}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Gambier

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):155
                                                                                                                                                                                                                                                Entropy (8bit):4.976931060677737
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDH5hBYfMXGm2OHKToxYoHsdNfis:SlSWB9eg/DDm2OHPxYoH4qs
                                                                                                                                                                                                                                                MD5:45330CE0FA604304C6ACF8EF8CAF51EC
                                                                                                                                                                                                                                                SHA1:20EEF9646996C2EC9B2641EBCCBE4766BF38B17B
                                                                                                                                                                                                                                                SHA-256:190E02A0C00D165FA45C73AEF9C0D6C82B1720E7406E5610DD860AED10A021A5
                                                                                                                                                                                                                                                SHA-512:51C7931B503405DA0B4078F6BE411895DD00E86AC7C5BE475030664D5302AD614293541DEE7FFC3D86A9DDB1BDA32BCAA746CF1D207DB063FBA2F9E9BE12836C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Gambier) {.. {-9223372036854775808 -32388 0 LMT}.. {-1806678012 -32400 0 -09}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Guadalcanal

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):157
                                                                                                                                                                                                                                                Entropy (8bit):4.9796189407775255
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDH5RyJTLJ5FNMXGm2OHddHvpoxYoHsdMWdHPVtyn:SlSWB9eg/LJHjXDm2OHdFGxYoHgHPLy
                                                                                                                                                                                                                                                MD5:DF09960360D8CEDCA2A4DC19A177C4A6
                                                                                                                                                                                                                                                SHA1:9F73F271B8C85B25FE6392B8BF7465C92EFFE621
                                                                                                                                                                                                                                                SHA-256:161762334DFF48B1D58824911E1FF4171386EA18234DD3DD5B0798515593086A
                                                                                                                                                                                                                                                SHA-512:1BE9E0F90DA529C99E317F399BFDB913A076651CF8801A1849247B26A350A76D8B5807AB139F3DBB97790DDFC332BDBEB57B364BF67FA2BB440AFEDC4130A648
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guadalcanal) {.. {-9223372036854775808 38388 0 LMT}.. {-1806748788 39600 0 +11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Guam

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):733
                                                                                                                                                                                                                                                Entropy (8bit):4.244282318063802
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB862mdHanCTCtBCv1yWQkHHLTaWJ+x+87W0x+8+yWSi+JW7+sWU0dwaW1j+FaW2:FeaC2twvY3knLGs+I87p+8d9i+J7s70c
                                                                                                                                                                                                                                                MD5:BA319E451BE323C852A8ABFC299DDA28
                                                                                                                                                                                                                                                SHA1:FC9314C162FF1FE1ED5E2C5DF962A55D4D6D8115
                                                                                                                                                                                                                                                SHA-256:42CB69ABC83415F63CA7D2A3E5314A41817AEE3206ECCC7172C50A74B1597DB0
                                                                                                                                                                                                                                                SHA-512:3BF733B9ED2A57B01BE173A8421B2D5A45888A230461EA0BD8C5B4AC7DC010BB527346731196141C70AFECDF88DD47AFE48636243DFC395D88E58231BEDF7D2A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guam) {.. {-9223372036854775808 -51660 0 LMT}.. {-3944626740 34740 0 LMT}.. {-2177487540 36000 0 GST}.. {-885549600 32400 0 +09}.. {-802256400 36000 0 GST}.. {-331891200 39600 1 GDT}.. {-281610000 36000 0 GST}.. {-73728000 39600 1 GDT}.. {-29415540 36000 0 GST}.. {-16704000 39600 1 GDT}.. {-10659600 36000 0 GST}.. {9907200 39600 1 GDT}.. {21394800 36000 0 GST}.. {41356800 39600 1 GDT}.. {52844400 36000 0 GST}.. {124819200 39600 1 GDT}.. {130863600 36000 0 GST}.. {201888000 39600 1 GDT}.. {209487660 36000 0 GST}.. {230659200 39600 1 GDT}.. {241542000 36000 0 GST}.. {977493600 36000 0 ChST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Honolulu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):344
                                                                                                                                                                                                                                                Entropy (8bit):4.640604617840767
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/PeDDm2OHsVVoHvBrai3UNFv+rUXaWFvAHovj/0nvCv7p+v:MB86WXmdH0VCvBz0GOTA0/0y74v
                                                                                                                                                                                                                                                MD5:F3F0E64655FAA79E40860765EEBB5B77
                                                                                                                                                                                                                                                SHA1:7F6C2FC100AEABC26B7205AB53C1E016B12E4D60
                                                                                                                                                                                                                                                SHA-256:69319015799D32D3CF7C0A3E9991B4B1F3E0C5D1B4FBF400517350CCA9D2C3B7
                                                                                                                                                                                                                                                SHA-512:7C9238BCCB13B90D4DC9B5E776C421A42C25D21B4E026406F57FA1E70983E8F6BF1CE927AB9D0D6261C5C1802A8B810399F506915262F82F487417CFD704B2F1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Honolulu) {.. {-9223372036854775808 -37886 0 LMT}.. {-2334101314 -37800 0 HST}.. {-1157283000 -34200 1 HDT}.. {-1155436200 -34200 0 HST}.. {-880201800 -34200 1 HWT}.. {-769395600 -34200 1 HPT}.. {-765376200 -37800 0 HST}.. {-712150200 -36000 0 HST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Johnston

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):193
                                                                                                                                                                                                                                                Entropy (8bit):4.844454917943834
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yc6e8SHAIgOb6eKAN/NWyVheo:MByMdniinbtNWzo
                                                                                                                                                                                                                                                MD5:4244078A03C2493009EF2F6BDA2F326F
                                                                                                                                                                                                                                                SHA1:AC2FF3E91A8831A479B33DF32A0118BC2EB255D0
                                                                                                                                                                                                                                                SHA-256:6E52B361AC8A6A578C709F6D58AA7535F06C0CB1707081C2D5A63FA8545D955C
                                                                                                                                                                                                                                                SHA-512:398B32E0FAF80E40DF3ACD203DF380D61DC39322F0BA0388A18281BC26973945F45683A104B9A785BB9DF5E514322F6994F934289E4B56B7982F94D4528D4272
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:Pacific/Johnston) $TZData(:Pacific/Honolulu)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Kanton

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):208
                                                                                                                                                                                                                                                Entropy (8bit):4.669308556946547
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/KyXDm2OHEMmzQwXy29BVyv7y/fTVVFty:MB86KyTmdHEZzQUBVyDy/fZvty
                                                                                                                                                                                                                                                MD5:544A0A83241333805192A6F03888E359
                                                                                                                                                                                                                                                SHA1:99D2BE79D57B44BD538386F9E7551C9E1874D7E3
                                                                                                                                                                                                                                                SHA-256:0B1345555EC2B4738CC4DEBFE496C287966F238386263032FF1E27912CCBFBA6
                                                                                                                                                                                                                                                SHA-512:61C91265632D01FBB7F4C739368756C428258FA6C141E49E88B6C78ABEA6150A74B8DFCF14C5AADDA03C1EA6F04D122734654495C26B8614561786B1C5C7EF10
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kanton) {.. {-9223372036854775808 0 0 -00}.. {-1020470400 -43200 0 -12}.. {307627200 -39600 0 -11}.. {788871600 46800 0 +13}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Kiritimati

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):219
                                                                                                                                                                                                                                                Entropy (8bit):4.739672105601744
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/iSDm2OHjkeoHvmLVFFz4YWXfSzvjNv:MB86iGmdHpCvU4VfSbxv
                                                                                                                                                                                                                                                MD5:1B695BBB9C50F6AFC05F67DE30374160
                                                                                                                                                                                                                                                SHA1:08AD8BBB6C99EB36FC3E462DB41C6896F52F150C
                                                                                                                                                                                                                                                SHA-256:4F7235B956A5A01676BE05275E086D5157EBC24FD91022E87817020669F915F7
                                                                                                                                                                                                                                                SHA-512:DC35CB1C2E5E035A82F91D1B1F4B48D7B112D9B7A1A7DB9C4A4C42C4D58002E1ECD9D24B2EA5B624DBB526ADDF9A8AB37D4315843207C34C16B2EFE33A254752
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kiritimati) {.. {-9223372036854775808 -37760 0 LMT}.. {-2177415040 -38400 0 -1040}.. {307622400 -36000 0 -10}.. {788868000 50400 0 +14}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Kosrae

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):394
                                                                                                                                                                                                                                                Entropy (8bit):4.441317927120857
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB869nmdHlCTvrvCvKcHwzHHI/HKOjHHwZaLYkcy:2ecrrqvGznISknwZaLxcy
                                                                                                                                                                                                                                                MD5:B489D7BDE8EB805B2A24726A6FB0C441
                                                                                                                                                                                                                                                SHA1:7997A33AA56857EC52B1198DBEF4CE1DB50D69FD
                                                                                                                                                                                                                                                SHA-256:B528E5E712E5F878603183E7CCFF55E5DB97CB47D7628BCB635342796317B899
                                                                                                                                                                                                                                                SHA-512:4898AC2747FB8620BE29933CC7AA344AF1A3B7777D1AFF08BB4C6CE6E7AF205581937CCB488F3CB39CC8CA7FB42EDC8E1CAD8BADC9FCA40E3CAD23271CD66FCB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kosrae) {.. {-9223372036854775808 -47284 0 LMT}.. {-3944631116 39116 0 LMT}.. {-2177491916 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 39600 0 +11}.. {-7988400 43200 0 +12}.. {915105600 39600 0 +11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Kwajalein

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):304
                                                                                                                                                                                                                                                Entropy (8bit):4.5947337310364835
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/yEyDm2OH4T2eoHvmfKnOjvScHrkL/Xy2185k0YAov:MB86XmmdHWCv6KOjHHgLN8tby
                                                                                                                                                                                                                                                MD5:7D1FC9913941693ACBD6A3CCB2F34555
                                                                                                                                                                                                                                                SHA1:D07C8AAED1DF9614BCA6EEF0F72FB98BE46CF5EF
                                                                                                                                                                                                                                                SHA-256:38133BE70100D7DC244A680827879E6B240646C7C0B68F58652051E681A71985
                                                                                                                                                                                                                                                SHA-512:419F0A1D1D71C8F84765C7B54271D7EFD6A81F428751523A214ABB24A8770DD5A7666F634A20AF97D5AAB8F21C0DEF23DCDE068CF4C1CCC7639ABC43864A9DBC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kwajalein) {.. {-9223372036854775808 40160 0 LMT}.. {-2177492960 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-817462800 39600 0 +11}.. {-7988400 -43200 0 -12}.. {745934400 43200 0 +12}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Majuro

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.7986219497241995
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGqhyXHAIgObTq0vFvRL/nUDHznHlUDHqNn:SlSWB9vsM3ycmhSHAIgObmSN/QxNn
                                                                                                                                                                                                                                                MD5:EB409C340A475B60993965A0E2892B6E
                                                                                                                                                                                                                                                SHA1:819881A078F34EF8FC55D71D829B82C56E6723D7
                                                                                                                                                                                                                                                SHA-256:935BC00C13863715D09463E54DC2A6FF0F1A7EEA8D5895C87836AA59716CBD57
                                                                                                                                                                                                                                                SHA-512:A28AF85022F8B3C2EE5F93BF6FDC0C349B73F25D88BA151ACE424EED1A95FA29608A6B1AD3D5FD952B2FB7F48DF6FDF8E6504F2B53E6782E4FF73335AF9A15C0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Tarawa)]} {.. LoadTimeZoneFile Pacific/Tarawa..}..set TZData(:Pacific/Majuro) $TZData(:Pacific/Tarawa)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Marquesas

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):159
                                                                                                                                                                                                                                                Entropy (8bit):4.976348164850869
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHzrHeWNMXGm2OHOx5oHsdNpNFvvIVVFvYy:SlSWB9eg/cHeSDm2OHOnoH4/FvQVVFAy
                                                                                                                                                                                                                                                MD5:80CB45F42BAB1AA72CD7C7BC394DF3F8
                                                                                                                                                                                                                                                SHA1:8B5ED2BCCA1AEB41F22AFD14F46533959828B2BE
                                                                                                                                                                                                                                                SHA-256:AE0B5055C6E57516F23749B13681205EAD376E682959716A457B1377AF8160BA
                                                                                                                                                                                                                                                SHA-512:71562E340B7A96B91D04FCBCAF71B66EA725CA1BD1094343C4442F8F9A8C67A3BE378034849197407D21C3EE74E2C753B1FD3BAFF2378714B993AD9336236A0E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Marquesas) {.. {-9223372036854775808 -33480 0 LMT}.. {-1806676920 -34200 0 -0930}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Midway

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):194
                                                                                                                                                                                                                                                Entropy (8bit):4.81307101485774
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHz0HvUDHurKv:SlSWB9vsM3yciemHAIgObiecN/Zevn
                                                                                                                                                                                                                                                MD5:13CE48F8FF74BFCEFCB8D217D6357E38
                                                                                                                                                                                                                                                SHA1:296D31E3F868934C6EB34BF1BF4C23F3E1839294
                                                                                                                                                                                                                                                SHA-256:F62C6A2DEC1E9EC78115D5F14E5B9DB7C86F788662D2E68F7E6714F4A05DC974
                                                                                                                                                                                                                                                SHA-512:778813FC08EF803743F392000BECE73C1C079883DAFC26FAC0AF8FA3FA4AE1D94BA8F3CAA5E82DD4DB1A5F12AD49E123901908F5483E0E325952622AB4C4A26A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Midway) $TZData(:Pacific/Pago_Pago)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Nauru

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):244
                                                                                                                                                                                                                                                Entropy (8bit):4.702705620563736
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/JdDm2OHceoHx6sCH/ZdqvScH9cd0YAov:MB86J5mdH9CMhcHHauby
                                                                                                                                                                                                                                                MD5:30A8285FCCE2E98889E53DF60B906C3D
                                                                                                                                                                                                                                                SHA1:C7789CB11A2C8FE3861FF3C0A7A41F6CAFD87631
                                                                                                                                                                                                                                                SHA-256:22C367F3219B5FC736260D9DBFEF5FCB767F1A6BDA991C9352F790A3D1FFE884
                                                                                                                                                                                                                                                SHA-512:02DA82680588839B06F820979AECC78B7FBEAB9D6D49176B513B80F1C8BA2D55FB3674B19EFDD574EE6FC01539EF7C3081A4B34D14A54DACF367D816B62E5843
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Nauru) {.. {-9223372036854775808 40060 0 LMT}.. {-1545131260 41400 0 +1130}.. {-862918200 32400 0 +09}.. {-767350800 41400 0 +1130}.. {287418600 43200 0 +12}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Niue

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.846897598147338
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHwMQA3WNMXGm2OH0SNoHoRWVGXyOyovFaSUGFAZvBByV:SlSWB9eg/Jm3SDm2OHJoHFGXCodZUGFd
                                                                                                                                                                                                                                                MD5:6E8EC957423917AE7A7EF503661C1A77
                                                                                                                                                                                                                                                SHA1:B4FA3C3E3F96C28B7DB87BFD441D2EE99CC81B6F
                                                                                                                                                                                                                                                SHA-256:869CCA656BE88E4E7481C75737C3656BAB6924AD1751505815AC719C59269842
                                                                                                                                                                                                                                                SHA-512:9047ABE673259699C7A548BC7B5636DD646DD382C751B796522F65404162AB1B0BB022FD274653921E5B23C847EE248AEF6749E15ED2CFC1DCE35BBA294D8251
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Niue) {.. {-9223372036854775808 -40780 0 LMT}.. {-543069620 -40800 0 -1120}.. {-173623200 -39600 0 -11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Norfolk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5139
                                                                                                                                                                                                                                                Entropy (8bit):3.65794255179185
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:K/yg8hZbeS07HbbYTqge+gDrWnAxhejtB0e+Pwn1UVimqNQrKvyXrStkCDv:K/y7hNeS07sq0Erk10lINQrKvyXrwv
                                                                                                                                                                                                                                                MD5:E19700A894AA64715D14F501D8D2FA98
                                                                                                                                                                                                                                                SHA1:57CFC96E2EBB985720DB290F59181860AF2AC1AA
                                                                                                                                                                                                                                                SHA-256:5D16C3EF1DB996C1B8E33AD884C33946F77DA872F35F41EC3BD5B288F43CC9AF
                                                                                                                                                                                                                                                SHA-512:E11EAF2A7B217CDBEECB57635184F04171F0DB088FCC4702AA8D40A3A5453904592F5869849913E2EB02DC5941C84203A76D270E8930B0B691A3B9C39B78BF30
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Norfolk) {.. {-9223372036854775808 40312 0 LMT}.. {-2177493112 40320 0 +1112}.. {-599656320 41400 0 +1130}.. {152029800 45000 1 +1230}.. {162916200 41400 0 +1130}.. {1443882600 39600 0 +11}.. {1561899600 39600 0 +12}.. {1570287600 43200 1 +12}.. {1586012400 39600 0 +12}.. {1601737200 43200 1 +12}.. {1617462000 39600 0 +12}.. {1633186800 43200 1 +12}.. {1648911600 39600 0 +12}.. {1664636400 43200 1 +12}.. {1680361200 39600 0 +12}.. {1696086000 43200 1 +12}.. {1712415600 39600 0 +12}.. {1728140400 43200 1 +12}.. {1743865200 39600 0 +12}.. {1759590000 43200 1 +12}.. {1775314800 39600 0 +12}.. {1791039600 43200 1 +12}.. {1806764400 39600 0 +12}.. {1822489200 43200 1 +12}.. {1838214000 39600 0 +12}.. {1853938800 43200 1 +12}.. {1869663600 39600 0 +12}.. {1885993200 43200 1 +12}.. {1901718000 39600 0 +12}.. {1917442800 43200 1 +12}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Noumea

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):326
                                                                                                                                                                                                                                                Entropy (8bit):4.531117764974758
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9eg/JcSDm2OHTYoHgnX2czO/FxgV62JFy:MB86JcGmdHTYCgX2czUjgM2ny
                                                                                                                                                                                                                                                MD5:2F1E92A11DF44C72DC305C13111DEA35
                                                                                                                                                                                                                                                SHA1:847F551C3D6C75CD2D0D6D87FCF3294CA8DD90B2
                                                                                                                                                                                                                                                SHA-256:238683C027D2319C33D975A837E9FC9D24DD53B1A67108EDBF7ABDF0DB050881
                                                                                                                                                                                                                                                SHA-512:E35D8C71AFDBB9A7507E873925001AEDE3734B1D235F509D19952E85279CBCC233A73412EA1F79CB534A45D36FEAA8AFDA98D9964DC93C7892B318F4AFC9A076
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Noumea) {.. {-9223372036854775808 39948 0 LMT}.. {-1829387148 39600 0 +11}.. {250002000 43200 1 +11}.. {257342400 39600 0 +11}.. {281451600 43200 1 +11}.. {288878400 39600 0 +11}.. {849366000 43200 1 +11}.. {857228400 39600 0 +11}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Pago_Pago

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.985607855830399
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHurKeTFfXMXGm2OH2ivkeoHvUPi1TsYoHsdfWTVvvVFv:SlSWB9eg/XecDm2OH23eoHvWieYoHiWB
                                                                                                                                                                                                                                                MD5:E86D90DAA694B0EAC42F8C01346BC95B
                                                                                                                                                                                                                                                SHA1:CD29DEFC291C939296E86DC7EF5D0654D85285E8
                                                                                                                                                                                                                                                SHA-256:CCA96640AB3BC707224FA86D9AF66F9D53A204A97B370B2785BA8208688BF8B6
                                                                                                                                                                                                                                                SHA-512:937BA420061E3781F831779B458E914A0FC465C4B41796F8B7CB1E548822F5777A6450FC6002AB13EBC5C9F54E374D3ED731D05B2B302B95359BE34094E5062B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pago_Pago) {.. {-9223372036854775808 45432 0 LMT}.. {-2445424632 -40968 0 LMT}.. {-1861879032 -39600 0 SST}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Palau

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.919381181565273
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHugEZF3fMXGm2OHKvkeoHucRbgnJnoHvmdQ4+vScFAy:SlSWB9eg/Xg2PDm2OHK8eoHTWJnoHvmi
                                                                                                                                                                                                                                                MD5:2E6C7EC61C7E29A147475C223B163F6B
                                                                                                                                                                                                                                                SHA1:3A98D3441335224E7EBC0648990BCA1DE3BDF5C6
                                                                                                                                                                                                                                                SHA-256:97DE6C2C717BFEAD00F83B5D39D654C32CEE580226F5F084484EBAD57BBCE7FF
                                                                                                                                                                                                                                                SHA-512:5868C43966DDEBA8EC4BBBB29CDFDDFF0C7B01FD4D579FF655F3363029059F969B39C9221190672B6A2F7938583594AA0B103FC2A7ED573E2BC1C3A1623DE8DD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Palau) {.. {-9223372036854775808 -54124 0 LMT}.. {-3944624276 32276 0 LMT}.. {-2177485076 32400 0 +09}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Pitcairn

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.809907977056877
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHuQTWLMbNMXGm2OHUVFvoHvmXUlgloWkcyf/vGpn:SlSWB9eg/XQyLMJDm2OHUVVoHvmXUKm2
                                                                                                                                                                                                                                                MD5:3F4987676F9C461895EDF9985AD22E06
                                                                                                                                                                                                                                                SHA1:A96E470209010B837EF5BB3AC93BAE74BF2CCF64
                                                                                                                                                                                                                                                SHA-256:5D363729A986E24C79F4B817CC88D2B22ACCCE3ADD20138D51C4422C4297AD6F
                                                                                                                                                                                                                                                SHA-512:988FB98EFD3F57F5D66A932CC6B9D0387E9B0951FC590E08DAF19ACF5E4F39BC1B25265F16E14930BCF394902F5F0EF507E0E91C98902DFB10FA16D716091AB0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pitcairn) {.. {-9223372036854775808 -31220 0 LMT}.. {-2177421580 -30600 0 -0830}.. {893665800 -28800 0 -08}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Pohnpei

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.7682565894416005
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3ycaJHNPHAIgObaJHa6N/XyopJHYn:MByMdaJyiaJrtCopJ4n
                                                                                                                                                                                                                                                MD5:1B418E3A4239AAFE1E15B57FFF913FA1
                                                                                                                                                                                                                                                SHA1:0E278FCC058DE1B3F4715771819F14568A6C10BB
                                                                                                                                                                                                                                                SHA-256:F744CD8337C5C72023D61F348DD03F48824F817D62F54ACC6A23DDD8B0F9EDC4
                                                                                                                                                                                                                                                SHA-512:8E3E10B41CF64A07411B272C0BCA6DC7AA9FFBF625B31075651603B7D0A52A719F7174A67593BFDE45725C243D347D01560B2BC7813C2ABD2F4BF4B1BAD57E56
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Guadalcanal)]} {.. LoadTimeZoneFile Pacific/Guadalcanal..}..set TZData(:Pacific/Pohnpei) $TZData(:Pacific/Guadalcanal)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Ponape

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):200
                                                                                                                                                                                                                                                Entropy (8bit):4.742862539020017
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3ycaJHNPHAIgObaJHa6N/X3HpBJHYn:MByMdaJyiaJrtHpBJ4n
                                                                                                                                                                                                                                                MD5:514C399D990C87271812440A4B19FB21
                                                                                                                                                                                                                                                SHA1:E1512482D10C8984DCD69C883F07C412E144081A
                                                                                                                                                                                                                                                SHA-256:5BB11553F711BD591617F657A9D1811CC3E3FB46374F6867316A7C8F6B3765D9
                                                                                                                                                                                                                                                SHA-512:DB227134822EA73407B6C0259FF7413D4961B558F3018BFF51E4E426DDB2DF581DCF7A6DE9E4890CE35F785BC3D07CC880DA883C93D73FFB249F403701BD8023
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Guadalcanal)]} {.. LoadTimeZoneFile Pacific/Guadalcanal..}..set TZData(:Pacific/Ponape) $TZData(:Pacific/Guadalcanal)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Port_Moresby

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                                Entropy (8bit):4.945354510868153
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHuwKXI3SMXGm2OHwdvoHvZUeQTnoo3v/vnqMVVMUMy:SlSWB9eg/X/43SDm2OHwdvoHvZZQTnoQ
                                                                                                                                                                                                                                                MD5:2CFB7C2A3D26D7AF0F6AE32ADD81C364
                                                                                                                                                                                                                                                SHA1:80C96E50D23A9A9531E4EE33744CF445C054B901
                                                                                                                                                                                                                                                SHA-256:124C137B091D9D54D5E0579131485428FAAE040ACC978D20D6A8C8E4DE9889AA
                                                                                                                                                                                                                                                SHA-512:A215FF5A69BD3E786BD3F8C952C8593396402EFA85005F5342093028617A6862EAE8BFD7B6D5737F90D90897AB62CF785544A4157A222AE4D0F70797FFBEC2CB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Port_Moresby) {.. {-9223372036854775808 35320 0 LMT}.. {-2840176120 35312 0 PMMT}.. {-2366790512 36000 0 +10}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Rarotonga

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):969
                                                                                                                                                                                                                                                Entropy (8bit):3.943959457262612
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86VrjmdHI5Cvn9HCFkN00hjNFq++UE+q0hwA+A7VxVnDEFn:IeZv8w0MNFq+xE+uAtx1c
                                                                                                                                                                                                                                                MD5:64AD3A103F4D145C48484BF8FACF41C2
                                                                                                                                                                                                                                                SHA1:40C00CFA56C87E506C254A93A164D7227DFF3BD5
                                                                                                                                                                                                                                                SHA-256:5AB006A686E564E30C94884FF8A9D728AEC74681DA8772E9722B6FE203630B5D
                                                                                                                                                                                                                                                SHA-512:D1088C3B673B5456A8706B69BE4D7AB18615EE53A82BF4ABE76E86700837E6BAD0BD79C13EDA9B04776B08A95B835BA755AA565F86E45BFE507E8783896C1EE2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Rarotonga) {.. {-9223372036854775808 48056 0 LMT}.. {-2209555256 -38344 0 LMT}.. {-543072056 -37800 0 -1030}.. {279714600 -34200 0 -10}.. {289387800 -36000 0 -10}.. {309952800 -34200 1 -10}.. {320837400 -36000 0 -10}.. {341402400 -34200 1 -10}.. {352287000 -36000 0 -10}.. {372852000 -34200 1 -10}.. {384341400 -36000 0 -10}.. {404906400 -34200 1 -10}.. {415791000 -36000 0 -10}.. {436356000 -34200 1 -10}.. {447240600 -36000 0 -10}.. {467805600 -34200 1 -10}.. {478690200 -36000 0 -10}.. {499255200 -34200 1 -10}.. {510139800 -36000 0 -10}.. {530704800 -34200 1 -10}.. {541589400 -36000 0 -10}.. {562154400 -34200 1 -10}.. {573643800 -36000 0 -10}.. {594208800 -34200 1 -10}.. {605093400 -36000 0 -10}.. {625658400 -34200 1 -10}.. {636543000 -36000 0 -10}.. {657108000 -34200 1 -10}.. {667992600 -36000 0 -10}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Saipan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):179
                                                                                                                                                                                                                                                Entropy (8bit):4.854594370903023
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG5RFeyXHAIgObT5RV5RL/nUDHtluKpUDH5Rgn:SlSWB9vsM3ycdeSHAIgOb7N/vKbn
                                                                                                                                                                                                                                                MD5:EFC985F07B24BEDA22993C9D0EA7E022
                                                                                                                                                                                                                                                SHA1:6D05D12925621F1D05999A5DCC81B8C6F4D18945
                                                                                                                                                                                                                                                SHA-256:4F6A1C20A11E186012466091CD4B3C09D89D35E7560F93874DEC2D7F99365589
                                                                                                                                                                                                                                                SHA-512:5FB4D8784D2EB8AEF660D6CBC7C403561EE5874BEC0439762F3688C64830B52B1F557B467CA65B64B1210E82F385E134BF676F3CA443FB480702A2C90B3C3757
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Guam)]} {.. LoadTimeZoneFile Pacific/Guam..}..set TZData(:Pacific/Saipan) $TZData(:Pacific/Guam)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Samoa

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):193
                                                                                                                                                                                                                                                Entropy (8bit):4.78073436515702
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHthA5nUDHurK:SlSWB9vsM3yciemHAIgObiecN/NXevn
                                                                                                                                                                                                                                                MD5:8E335F5D0A2082BB673E7FEB56167A89
                                                                                                                                                                                                                                                SHA1:EF37235922D4477AC9B3D9576888CDE41E700741
                                                                                                                                                                                                                                                SHA-256:98D06302EFC18FAD7751F7E5A059FE4ABAFBC361FDC365FE1EB576209D92C658
                                                                                                                                                                                                                                                SHA-512:2572D99EE8BAF264B8A2EF3D7647D33A387EE83E036F9E7BDB21F64C2FCB43317AF9C899C8CDD822A2A5A207EF17504E71B217370473ED95AE925BBA2CFA90F9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Tahiti

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):154
                                                                                                                                                                                                                                                Entropy (8bit):4.946903999617555
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHqhFPMXGm2OHl/oeoHsdNqRU7vV:SlSWB9eg/TTPDm2OHloeoH4qRW9
                                                                                                                                                                                                                                                MD5:341B0F535043051A91A21297BFA39DC0
                                                                                                                                                                                                                                                SHA1:6AD9177FC237503E6D36DE5408790A68D5D36E2C
                                                                                                                                                                                                                                                SHA-256:440A87DDB4F304DCBEAED1B0DE8F6058840E597918B688E0782F584DA03B1BBC
                                                                                                                                                                                                                                                SHA-512:D97D399A0F1B4347F8AE5F15E43A8787697339AB0EFB4E1106C790528FFC529ADC5B44B231D95449D39DB464D84A5DDF7B61E7D190E3E2B0091D1EC204B530A2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tahiti) {.. {-9223372036854775808 -35896 0 LMT}.. {-1806674504 -36000 0 -10}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Tarawa

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):152
                                                                                                                                                                                                                                                Entropy (8bit):4.969953728206455
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QF08x/nUDHqQ3fMXGm2OHyyFpoeoHvmciRrWFN0UIoAov:SlSWB9eg/T+Dm2OHyyFGeoHvmbu0YAov
                                                                                                                                                                                                                                                MD5:AA67FBBB6A02F5B30486C54E3A5C11D7
                                                                                                                                                                                                                                                SHA1:C64FD3654A47A0ECDD681B8A4D9B621AC6D97DBE
                                                                                                                                                                                                                                                SHA-256:91AA5DA8D5D1E72B1F561D0AEAB4B07E02EDD4EB95AE8C9F1C503C820460599F
                                                                                                                                                                                                                                                SHA-512:FC170904098011C091622A263CA554CEE952D64888D3573EB324E0A262E1A0C0885C059429F0FFF9219FEB8F1B6B97EC34661DD8DD547124D0C6C0A1C8EE24B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tarawa) {.. {-9223372036854775808 41524 0 LMT}.. {-2177494324 43200 0 +12}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Tongatapu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):451
                                                                                                                                                                                                                                                Entropy (8bit):4.343299747430587
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:MB86PmdHmCdC/V7XZXw8Ut2rbUtGiAUtb4bUtqVy:iemn/VbKeOSy
                                                                                                                                                                                                                                                MD5:87CFDA2399A8126117E5BFC018B06518
                                                                                                                                                                                                                                                SHA1:6291611BCFB34293F9C20BA77170A13C1502C2ED
                                                                                                                                                                                                                                                SHA-256:ECC9D2E7AD7B5E5D6599CF442941595C99C4D69E802A4DDB4DA321898CDDE91D
                                                                                                                                                                                                                                                SHA-512:846FE07FEB82EC5F87FAE137D23074934246DBB7C7EE30F44F6C5373183B5FD2211B58E5CF1AB9A47938D282CA322FBDE80B58054FE6517CDC549992439F19A8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tongatapu) {.. {-9223372036854775808 44352 0 LMT}.. {-767189952 44400 0 +1220}.. {-284041200 46800 0 +13}.. {915102000 46800 0 +13}.. {939214800 50400 1 +13}.. {953384400 46800 0 +13}.. {973342800 50400 1 +13}.. {980596800 46800 0 +13}.. {1004792400 50400 1 +13}.. {1012046400 46800 0 +13}.. {1478350800 50400 1 +13}.. {1484398800 46800 0 +13}..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Truk

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.903352083734246
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yci/452HAIgObi/4oA6N/TAOA/4pv:MByMdNXiU5trv
                                                                                                                                                                                                                                                MD5:443F5FFA58C5DB1F02695C5B76DF4F5E
                                                                                                                                                                                                                                                SHA1:115AFE9C3EB36F836E2DF95AF42C43EA5C21C1E6
                                                                                                                                                                                                                                                SHA-256:323A858946A2E8EC67C28176977D646C0A0F6DC8B48F9C4A3F8E7112C9B1B71D
                                                                                                                                                                                                                                                SHA-512:33717F3423CE06D827445FEA85BE8A989712CF8C06C54A17B9610A4DAD50BF64CAE80DE15AB12AB0610CD6B5582A897DD9C543098108543FA3E6273AAD9467DE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Pacific/Truk) $TZData(:Pacific/Port_Moresby)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Wake

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                                Entropy (8bit):4.771810884789573
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGqhyXHAIgObTq0vFvRL/nUDHpbhpUDHqNn:SlSWB9vsM3ycmhSHAIgObmSN/0h9Nn
                                                                                                                                                                                                                                                MD5:992D44D728747D79E1F7EF47E3CB2EF2
                                                                                                                                                                                                                                                SHA1:8F05E8DA2A2A45F04B9B89BB34F0B7833B56A261
                                                                                                                                                                                                                                                SHA-256:B6041BC18B595E38953632ACAD1D25F7394BF7C759A72FCCD81AF637F8016373
                                                                                                                                                                                                                                                SHA-512:C59D360941240C8B11D892A930B6CFE141B1A55007483683AF400B1A0C98EF0BBBE7EF595EF6BA73A6EECB8E3D0658A681CF3203E5E32DE80DD61EDB9C6CBDB0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Tarawa)]} {.. LoadTimeZoneFile Pacific/Tarawa..}..set TZData(:Pacific/Wake) $TZData(:Pacific/Tarawa)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Wallis

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.752883303864462
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGqhyXHAIgObTq0vFvRL/nUDHpEsppUDHqNn:SlSWB9vsM3ycmhSHAIgObmSN/t+9Nn
                                                                                                                                                                                                                                                MD5:862ADA129322E53235ED5099A72FE8EE
                                                                                                                                                                                                                                                SHA1:7DAB7BF451CF0FE483EA512C0C733B090FF22EFF
                                                                                                                                                                                                                                                SHA-256:9601B749413D591D820AFAD431B3C30E577ACAB000EA11EC03DEB36EF0738DC3
                                                                                                                                                                                                                                                SHA-512:D9C94BE2F08220E49A336A5760DBF43FCB889ADA95E29117AE5E237E33E9EE50BD32203D2743346A21354AF3F1ADDA43A2953FB55205B6FA998A6294CC57F063
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Tarawa)]} {.. LoadTimeZoneFile Pacific/Tarawa..}..set TZData(:Pacific/Wallis) $TZData(:Pacific/Tarawa)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Pacific\Yap

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):200
                                                                                                                                                                                                                                                Entropy (8bit):4.896778032757086
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3yci/452HAIgObi/4oA6N/eP/4pv:MByMdNXiU5teev
                                                                                                                                                                                                                                                MD5:343CCAC12AEB0DD78FC60405DF938729
                                                                                                                                                                                                                                                SHA1:B7B4DF0178DEEC2BA6F23AF5CD896CF16CEAF224
                                                                                                                                                                                                                                                SHA-256:16CF9FAB116E5E1732B4B601DA919798985A0C15803F0964844C7040894C5DBA
                                                                                                                                                                                                                                                SHA-512:041609C63E95322460A31AC83BCC4F8F90B8D44B2740A5CF7E37F66CCD9F928416D74D313370516D7B1780DF2C9C9A78B7069CE2DA6BFFE88C46FB47CE1A4CB2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Pacific/Yap) $TZData(:Pacific/Port_Moresby)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Poland

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):174
                                                                                                                                                                                                                                                Entropy (8bit):4.940195299412468
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVqEGIV5XHAIgoqpEGYvWARL/nSi67x/yQa0EGIy:SlSWB9vsM3ymc4HAIgocVAN/27x6qF
                                                                                                                                                                                                                                                MD5:E6AA2F6A05B57AA9B4AEF8E98552EEB2
                                                                                                                                                                                                                                                SHA1:22470C204152702D8826CA52299E942F572C85ED
                                                                                                                                                                                                                                                SHA-256:C27E1179B55BF0C7DB6F1C334C0C20C4AFA4DBB84DB6F46244B118F7EAB9C76E
                                                                                                                                                                                                                                                SHA-512:B28A264907C32F848D356FB0F5776C2CE819DCB6BC08A5E2DCD4FA455EE1616966E816748079C7A55485BABFFB292D567E6F958168F945889E33A267B0E7EDA9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Warsaw)]} {.. LoadTimeZoneFile Europe/Warsaw..}..set TZData(:Poland) $TZData(:Europe/Warsaw)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Portugal

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.9353841548970205
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxMvLS3vXHAIgoqyMvLL6RL/nM24h8QavMvLBn:SlSWB9vsM3ymvMv2PHAIgovMvH6N/e8i
                                                                                                                                                                                                                                                MD5:7D7BD6E40D3ADCA04754255D69B5CC9D
                                                                                                                                                                                                                                                SHA1:EE32167B450DE7B0F1A15199795AEF9524BE623B
                                                                                                                                                                                                                                                SHA-256:EFD666F3062D52C5D0B4F83B1A206E6840C1EAEC356CD77A0A71C7EDFA78C964
                                                                                                                                                                                                                                                SHA-512:6056AAF078316A89079D19555F0BAEFB4C1CDBAA5426A8BEE76E0BFA5C69A5DAAFD199DEF978ABD67287AE1B80F754B7845EAFD5CC0995FE10E44D1F34D5435C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Lisbon)]} {.. LoadTimeZoneFile Europe/Lisbon..}..set TZData(:Portugal) $TZData(:Europe/Lisbon)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\ROC

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):165
                                                                                                                                                                                                                                                Entropy (8bit):4.795776391333205
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qMveyXHAIgNqBLFARL/lOr4WFKfMy:SlSWB9vsM3yKMveSHAIgcBJAN/S4wKfB
                                                                                                                                                                                                                                                MD5:C5AE3A1DAD32C870651C74E367F604CF
                                                                                                                                                                                                                                                SHA1:9FF81383C43D98441841E182BC783381EF565204
                                                                                                                                                                                                                                                SHA-256:9AEC39777013B23D63D0509EBB2F01D57A2C1592264DBB19CE2C61C7D7DDD8DE
                                                                                                                                                                                                                                                SHA-512:3A7217ED885011972262B71DB7F5D7E4C9C6E82B4BEEF0718BCB9452E49FDBDD5ED78564156577AB09150140B862E1944B4B739BCE0C50E63667050C35329503
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Taipei)]} {.. LoadTimeZoneFile Asia/Taipei..}..set TZData(:ROC) $TZData(:Asia/Taipei)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\ROK

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):162
                                                                                                                                                                                                                                                Entropy (8bit):4.900717350092823
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8ZQckovXHAIgNtvQMHRL/lmFeWFKKQ7:SlSWB9vsM3yJJHAIgbHN/pwKv
                                                                                                                                                                                                                                                MD5:59E4C80F97FAFC92987B08BFA03B5EE5
                                                                                                                                                                                                                                                SHA1:4F86FCE17A51C3789DEB887BE01A1A0E6EA3D2DE
                                                                                                                                                                                                                                                SHA-256:63153B40225270ADB7CD248788CA9F18C6DEBAF222B3165BBAB633337592DF44
                                                                                                                                                                                                                                                SHA-512:9FCC0F747096775D0FB8DD252A73E6F47C16BF2D7DB0C3FBDFD206EE57393276FB40F65C1441296AE2AC115CFEE11098474DF3FEF8EE1FABE139427A8991F052
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Seoul)]} {.. LoadTimeZoneFile Asia/Seoul..}..set TZData(:ROK) $TZData(:Asia/Seoul)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Singapore

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.85623787837429
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq801c3vXHAIgNtK1tyHRL/kZ8O5h4WFKf1z:SlSWB9vsM3yUgHAIgWv6N/kth4wKf9
                                                                                                                                                                                                                                                MD5:5EABBAAF3B29B5DFF9E54136F7ABC654
                                                                                                                                                                                                                                                SHA1:44615F03264012D97512F9AB386413DD72BE1090
                                                                                                                                                                                                                                                SHA-256:B9443FB17F0128DDB9F2DF657DC5D2DF176F64C61B0D02B272E5DFB108537678
                                                                                                                                                                                                                                                SHA-512:B930D637A1E69E0847ADDEAB013B2C25BC27EBB9CDF20B9CDDFDAC111E9F26BB5EBC83194E845ACC3E1B9A08C386C94FCC4FDE32292EB558E3F7463832BB38B9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Singapore)]} {.. LoadTimeZoneFile Asia/Singapore..}..set TZData(:Singapore) $TZData(:Asia/Singapore)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\AST4

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):201
                                                                                                                                                                                                                                                Entropy (8bit):4.996391010176349
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSNJB9vsM3y7p5oeSHAIgppON/kjx+90ppv:JByMYbpwt8+90b
                                                                                                                                                                                                                                                MD5:1AC81E2C60D528A6C5BF2E6867146813
                                                                                                                                                                                                                                                SHA1:73D2D24FE6D56CA34ABF11B9A95DC22F809C5158
                                                                                                                                                                                                                                                SHA-256:978C4E5256057CE7374AD7929605090FC749B55558495BD0112FB0BB743FA9C2
                                                                                                                                                                                                                                                SHA-512:DB2673FB54C1308BBEB298A186F9130FB9090CE33B958C82D62B9BD88EE39BAB9A1BE40645547BA4167FD475892A323CF8EBA16C97F6FDF5693F1BF7A313FE9A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\AST4ADT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                                Entropy (8bit):4.9470542553730255
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/kRDwh4IAcGE2NEOyn:SlSNJB9vsM3y7UEOXHAIgpUEqA6N/k+H
                                                                                                                                                                                                                                                MD5:2AB4B896957F26B114A990F69989F3FB
                                                                                                                                                                                                                                                SHA1:8048C99F5EE02C021F311709B30EB28D650D884D
                                                                                                                                                                                                                                                SHA-256:0114C111F5BCD838A28F2E16E01ECB79D8AFC8CBF639A672889ED0D692FC6CDC
                                                                                                                                                                                                                                                SHA-512:353744359CD94B1E8184A8B83F762459C69D3AEEA43DA638C1F4CC34E01E9D86C2EBCF7F7BFD059CB23B64051510D1C4556A49D180F8A92DE8449139194DCDC9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\CST6

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.957831162100758
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/kR/eIAcGEsAzEpv:SlSNJB9vsM3y7hzi2HAIgphznN/kc90q
                                                                                                                                                                                                                                                MD5:3EC0B09EAB848821D48849673B24401C
                                                                                                                                                                                                                                                SHA1:41599CBA78E124A7DA9744D2B4EA8CDC10008E0B
                                                                                                                                                                                                                                                SHA-256:30428B85B37898AD98B65BE5B6A8BD599331D9A1B49605FC6521464228E32F8F
                                                                                                                                                                                                                                                SHA-512:9A3303B3338C01B281A40BB48B93C446ADB92BBDC45371667F09EDA92F9EE2AEC60CE8E98CE15C0112B823799C76AEF14895B15DC997DA506494D75BBE58D662
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:SystemV/CST6) $TZData(:America/Regina)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\CST6CDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                                Entropy (8bit):4.975428048518589
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx096yXHAIg20961yHRL/kRwx/h4IAcGE967:SlSNJB9vsM3y796SHAIgp9616N/kyxpQ
                                                                                                                                                                                                                                                MD5:D85CCC5EFAA1ED549D02F09A38A53C68
                                                                                                                                                                                                                                                SHA1:642ED571E4C6F60A953D42DA4F756F2262E4E709
                                                                                                                                                                                                                                                SHA-256:44BEF7D4660A9A873EB762E3FDC651D31D97893545DE643FA1B2D05991C090A1
                                                                                                                                                                                                                                                SHA-512:3CC6A14A17EA4833958A7D444073D6C2709FD61BF54387E5C362151E9143F795B2432B621080DD53E0FC9BDD7C58F406E046E3D0A2BBA4132D99E7C705E6D645
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\EST5

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):4.928128138328689
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSNJB9vsM3y73G7JHAIgp3GZRN/kkp4903G8:JByMY3G7Kp3GntVp4903G8
                                                                                                                                                                                                                                                MD5:506D15E2F37F501F5A592154142A5296
                                                                                                                                                                                                                                                SHA1:5ACA12E0BA0FFF9734ED978A9C60AAA9D1E05A59
                                                                                                                                                                                                                                                SHA-256:798F92E5DDA65818C887750016D19E6EE9445ADFE0FCB7ACB11281293A09C2C7
                                                                                                                                                                                                                                                SHA-512:2EE08D39461CAD3492BE88B421BA463B4CEB8497F036518794BCF605F477057FEA218A9DFBB6335A28A5120750EA06AED9D2EA84CD0007D34CDE562DCD79CC0C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indianapolis)]} {.. LoadTimeZoneFile America/Indianapolis..}..set TZData(:SystemV/EST5) $TZData(:America/Indianapolis)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\EST5EDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):195
                                                                                                                                                                                                                                                Entropy (8bit):5.113680059406992
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSNJB9vsM3y71RHAIgp1aAN/krp4901Yn:JByMY4pltw+90q
                                                                                                                                                                                                                                                MD5:AAD8EF3067E97785D4052B80F5C4ACE1
                                                                                                                                                                                                                                                SHA1:3EF0A06FCC41119F4A60A32CED0E5A1E0E8B4300
                                                                                                                                                                                                                                                SHA-256:D159140114A13C69F073CFE9AD0B67D713E8811CBFF773A3D1681FC38EA0E699
                                                                                                                                                                                                                                                SHA-512:A8774ADF6818D85476A6C147A45E55B338F413CD9B61BF9FDB0CB7A335C0CE8F8C6D1970783FEFECC2CE18388DF91304CB295BD4DFD29FB538D74F6A414A441D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:SystemV/EST5EDT) $TZData(:America/New_York)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\HST10

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):193
                                                                                                                                                                                                                                                Entropy (8bit):4.9733028894475195
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSNJB9vsM3yc6e8SHAIgOb6eKAN/kQmrheo:JByMdniinbtRTo
                                                                                                                                                                                                                                                MD5:458061B3F3C8F06C61B5726393A26BA2
                                                                                                                                                                                                                                                SHA1:E894F5615654D1110C9964B8F6A54C048442D8EB
                                                                                                                                                                                                                                                SHA-256:BF62C8650BBA258000F62F16B0C7CBB66F4FD63F8CFDAF54273BB88A02A6C8D6
                                                                                                                                                                                                                                                SHA-512:6A161A7AE44CBF8CE4C704C94456A5B714AAF2A3FAF30731254C9FE056F9DDF207119D516CC6A4C44AE76EC078F5C59F5EC6DD6701FAA3A36F061AF3953B7C7D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\MST7

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.999038624718282
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/kRgFfh4IAcGEuto:SlSNJB9vsM3y7OBHAIgpONYyHN/kch4y
                                                                                                                                                                                                                                                MD5:B06AB4998A57446FC4D5A5B986BCA0A9
                                                                                                                                                                                                                                                SHA1:5E4A28466383CBAB2067B9B6D22882CF6D83C3FB
                                                                                                                                                                                                                                                SHA-256:FEBE49FAE260E5595B6F1B21A0A3458D8A50ACA72F4551BF10C1EDB2758E0304
                                                                                                                                                                                                                                                SHA-512:9E44174C4E348E1B768039585BA6393FD001B606E111092EEC57C75210A1E87BF3C72728321945D584CA60D4C848D88EB8B2F82CB88F38F90224A43FDCFEA9AA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:SystemV/MST7) $TZData(:America/Phoenix)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\MST7MDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.956231227702093
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/kRMMFfh4IAcGE6RB:SlSNJB9vsM3y7+SPHAIgp+ON/kD490+B
                                                                                                                                                                                                                                                MD5:5D3C1ADB8AC4EAC9E9A31734CD6884BD
                                                                                                                                                                                                                                                SHA1:535B024EA088B9B192BE4206CBDD56BC5B163762
                                                                                                                                                                                                                                                SHA-256:64556A7B20E425C79375C2A7CCF72B2B5223A7DE4FF4C99A5C039DB3456C63F6
                                                                                                                                                                                                                                                SHA-512:FB799A42880613752AD6010D7B4E97ACCF7F6AE281D9A37057F6423AEF2607B608DB2AC52176F1653D8B2D086223C9658B101E73125F0FF7D6D9E8CD876EEC53
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:SystemV/MST7MDT) $TZData(:America/Denver)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\PST8

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                                Entropy (8bit):4.831981174214766
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqTQGuQTWLM4YkovXHAIgObTuQTWLovFvHRL/kRQB5nv:SlSNJB9vsM3yciQyLM4YJHAIgObiQyLQ
                                                                                                                                                                                                                                                MD5:B568B46A0207800D9C022BAB1E48709B
                                                                                                                                                                                                                                                SHA1:71CE3F0E75E440D5BBA219BCBB92AF9C1F5A7466
                                                                                                                                                                                                                                                SHA-256:0B8227AFC94082C985E8E125DF83E5EFADE7CD9CA399800D7B8E8B2BEAE22C7D
                                                                                                                                                                                                                                                SHA-512:5067AAD0CD02EBDECA6980F9C7CCC80D076C34D6463C5B6B19B678D76B5E69C1C3639D046F56FE9D6255CBEA49189EDD735F66AD9EE2CB0389BE020E7ED3AD50
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pitcairn)]} {.. LoadTimeZoneFile Pacific/Pitcairn..}..set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\PST8PDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):204
                                                                                                                                                                                                                                                Entropy (8bit):5.003766957083974
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSNJB9vsM3y7DvPHAIgp5N/kQ1p490Dy:JByMY8p5th090W
                                                                                                                                                                                                                                                MD5:7E587175CA0F938C47FA920D787C57BD
                                                                                                                                                                                                                                                SHA1:C3F7D8576C0AC74D6B70F4363EE2C174FADC70B0
                                                                                                                                                                                                                                                SHA-256:D51D9549835E9C058F836C8952932CB53C10F7F194CD87452E9B13494D1C54C9
                                                                                                                                                                                                                                                SHA-512:4460686AAA470F07A6DB1F8957FA4DB600E116273497F46E8A2D3FDECF622122DF753556B78C39FA2ADFDB2AF3C3ABB3C330ADA79B35C6A3CD8C498A0319CEE6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\YST9

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.9524733332469095
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqTQG5hB5WXHAIgObT5hByY6RL/kRKlUDH5hBpvn:SlSNJB9vsM3ycT2HAIgOboN/kNv
                                                                                                                                                                                                                                                MD5:5970A466367825D72D9672293FCD4656
                                                                                                                                                                                                                                                SHA1:1A736D61A6797295EEC8C094AED432171E98578E
                                                                                                                                                                                                                                                SHA-256:55710EFDED5B5830B2F3A2A072037C5251E1766F318707ED7CD5EB03037FED43
                                                                                                                                                                                                                                                SHA-512:1F2A1B2A7D0A3E410652546C174D9EC18C91C9327F11C384A0AA1EB12D7EFE85C4D53CA3C2A6C347C0068A4CE92A3138EB17232B0DEC88D52465C5DEDEEE6827
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Gambier)]} {.. LoadTimeZoneFile Pacific/Gambier..}..set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\SystemV\YST9YDT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):198
                                                                                                                                                                                                                                                Entropy (8bit):4.994125896811442
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSNJB9vsM3y7/9EtDSHAIgp/9Ef6N/kB490/9E9v:JByMY/947p/9XtN90/9s
                                                                                                                                                                                                                                                MD5:560B18DFB138DAF821CFDAE017B94473
                                                                                                                                                                                                                                                SHA1:0BB0312C742CC0097DF033656AE3D10723035C30
                                                                                                                                                                                                                                                SHA-256:DA20018DE301F879E4F026405C69FA0370EB10184FE1C84A4F1504079D5DAFA1
                                                                                                                                                                                                                                                SHA-512:B1D4EAD5F549E319DAD55EE67DAFD732E755164748C08633AA8F07C280B2CF617380D6F886304142D0E4D50026E63678DACFBE2DC809F780BA4CFF35A90DE906
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Turkey

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):180
                                                                                                                                                                                                                                                Entropy (8bit):4.9295990493611495
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/jCl1yQaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/SymKv
                                                                                                                                                                                                                                                MD5:1FABF2DFD4BFD0184AE22ED76F7569E5
                                                                                                                                                                                                                                                SHA1:5859266B26357B4FCADD7EC65847667631E303EB
                                                                                                                                                                                                                                                SHA-256:8471A5575B9D9E47412D851A18A26C4405480540AABC8DAED5F81BE0C714C07C
                                                                                                                                                                                                                                                SHA-512:1DCBECEF6D1F923E6C9CEA70CB10F1FF4E453265966AA88FBC8739E93EF40F8A16AAD85AF4ECC5CC1E52F22F49E5D3F4EE01A97DE2302FC4FBC063FE814F3851
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Turkey) $TZData(:Europe/Istanbul)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\UCT

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):153
                                                                                                                                                                                                                                                Entropy (8bit):4.844017562912325
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iGMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/iP8RX
                                                                                                                                                                                                                                                MD5:DA060D2F397C978E0842631B4EC73376
                                                                                                                                                                                                                                                SHA1:649BC85430B04662BE079C0AAD43DF5D5D499D28
                                                                                                                                                                                                                                                SHA-256:356A9BB6F831971C295CF4DCE0F0CDC9EDF94FD686CA3D3195E5F031A0B67CBA
                                                                                                                                                                                                                                                SHA-512:3359BFC6F0837D2DA9D72DA8053773CE0C1A1B1A47C33163BF38965E2104F57BC147F9EEC228A3591B75BF1BA93285AB83E8427E8E2E697AB18501DC017B6E6A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:UCT) $TZData(:Etc/UTC)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Alaska

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):189
                                                                                                                                                                                                                                                Entropy (8bit):4.911775112130145
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/VXEtDovXHAIg20/VXEfovRL/iOGl0IAcGE/VXEN:SlSWB9vsM3y7/9EtDSHAIgp/9Ef6N/i4
                                                                                                                                                                                                                                                MD5:4379C0BF618649AA07CC4BDAC75F62EF
                                                                                                                                                                                                                                                SHA1:7813B54BF2BD0C40A39CA9A29CC50C6D034880A3
                                                                                                                                                                                                                                                SHA-256:CED56F09D68BE00555219594C7B2F3E7EFE8323201FB3E2AA0E1FA9A6467D5AF
                                                                                                                                                                                                                                                SHA-512:AC822061F5C9743120A66E11C02B199253A40460A87F78DC154B0BDD91E410EDDA581E889F5D2A74670939034F39A7F6C7E814E038A1371DAB71EF79A8911AE7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:US/Alaska) $TZData(:America/Anchorage)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Aleutian

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):176
                                                                                                                                                                                                                                                Entropy (8bit):4.8886795125313585
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/iObMEIB/4IAcGE/y2:SlSWB9vsM3y7/yrHAIgp/yH0AN/itE8h
                                                                                                                                                                                                                                                MD5:AB14CF1840CBDA2B326660DBD51273B4
                                                                                                                                                                                                                                                SHA1:78144B3A2C75568307E4E86AE3B01EA7F541B011
                                                                                                                                                                                                                                                SHA-256:A4F1398CF84D0AE09BF19288770756622D1710CCBFBFE79E0D3239497731287D
                                                                                                                                                                                                                                                SHA-512:557A3ED9D1401E76291DC41524A1FD04AFF0829CEF66E103CEF9D10CD751F04FDEB6B7C0490302C71297F53AA8DC42930649AD274215D5DF068BCDE837E73756
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:US/Aleutian) $TZData(:America/Adak)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Arizona

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.9334626069754455
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/iQMfQfBx+IAcGEB:SlSWB9vsM3y7OBHAIgpONYyHN/iZfQfl
                                                                                                                                                                                                                                                MD5:30ED80335BE37C7CBA672C33FDE23490
                                                                                                                                                                                                                                                SHA1:B627E86F023FE02A5590FE8D55FF41946BE6D24B
                                                                                                                                                                                                                                                SHA-256:9503403F231BA33415A5F2F0FDD3771CE7FF78534CE83C16A8DB5BC333B4AD8A
                                                                                                                                                                                                                                                SHA-512:C1352612EC0B4FF2F6F279CDB6008D7E9DA7F94F0009EFD959AD3092393150ECA83A09E72C724E1A4BFC3A057B9218D54A87FFA1102E2D9BF058B78AC0A0B1AB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:US/Arizona) $TZData(:America/Phoenix)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Central

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                                Entropy (8bit):4.90255068822036
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx096yXHAIg20961yHRL/ibXgox/h4IAcGE967:SlSWB9vsM3y796SHAIgp9616N/iB490+
                                                                                                                                                                                                                                                MD5:7770A6B85B2FE73BCCE9D803E0200F23
                                                                                                                                                                                                                                                SHA1:784AD1082FF1569961C2AC44F6D6F7605FBBE766
                                                                                                                                                                                                                                                SHA-256:B6AC9FAE0AB69D58ECFD6B9A84F3C6D3E1A594E40CEEC94E2A0A7855781E173A
                                                                                                                                                                                                                                                SHA-512:EEE79D37D77E6B80B91E8F30CE48B107371F6A58F0C91785E3C74EF210AE1011D0EB913113F1873BE6099B0BE1260410F0C74650446CB377F8FDB5505A44F266
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:US/Central) $TZData(:America/Chicago)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\East-Indiana

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):228
                                                                                                                                                                                                                                                Entropy (8bit):4.7645631776966715
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/i3E0903GK8:MByMY3GK7Kp3GKnti3t903GK8
                                                                                                                                                                                                                                                MD5:96828B6BA17CA96723794F4B3744B494
                                                                                                                                                                                                                                                SHA1:C3A824A925AEFE2A13A0E65548078D9842C2C7D7
                                                                                                                                                                                                                                                SHA-256:5D86F8D36598516FB2342A18A87DB2701BABD265B0671CC9321C48DB22C7ECA5
                                                                                                                                                                                                                                                SHA-512:2A27A455787DEAC3EC78A2784FB989DAB178E9D6DD7721CD3F5D3337231A3C651994B964D6CE040B7858E0127D7F70C0C48CB0D553D5B725B649C828288224B5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Eastern

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                                Entropy (8bit):5.0345860115708785
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wAy0vfXHAIg20wAyGWARL/i37oxp4IAcGEwAy0yn:SlSWB9vsM3y71RHAIgp1aAN/i37oxp4P
                                                                                                                                                                                                                                                MD5:375DB249106C5D351CA0E84848835EDB
                                                                                                                                                                                                                                                SHA1:ECC5C0C9DA68773B94C9013F4F1A8800D511CC4C
                                                                                                                                                                                                                                                SHA-256:2FFCAD8CBEF5ECDC74DB3EE773E4B18ABC8EFA9C09C4EA8F3A45A08BADAF91A9
                                                                                                                                                                                                                                                SHA-512:21550743BF4E1A79754F76AB201F0EB6BA6B265F43855901640054316A4A32A5D01D266B2441E4A6415720715A2ABD367D82E3D40949A7A66BE9F8366E47A8DD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:US/Eastern) $TZData(:America/New_York)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Hawaii

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):186
                                                                                                                                                                                                                                                Entropy (8bit):4.88075715646936
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG2fWGYFeyXHAIgObT2fWKARL/ioMN75nUDH2fWWv:SlSWB9vsM3yc6e8SHAIgOb6eKAN/ioER
                                                                                                                                                                                                                                                MD5:C0475756CFEC302F737967468804846E
                                                                                                                                                                                                                                                SHA1:85C13CA0A908C69B8BBB6040FC502AFF96B8F8C7
                                                                                                                                                                                                                                                SHA-256:529BB43EFDA6C1584FEAEA789B590CEF1397E33457AB3845F3101B1FC126E0FB
                                                                                                                                                                                                                                                SHA-512:D3FF374443344E8438D50803872E8A8EA077B2299B38C1BD155386B4D2C6008BBD0C0B0B26DE9680812D4AFC9A187B644BDCCB04C23880337228BCEC06D5D61B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Indiana-Starke

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):206
                                                                                                                                                                                                                                                Entropy (8bit):4.87340978435866
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:SlSWB9vsM3y73GKaHAIgp3GKIN/iGIfh4903GKT:MByMY3GKDp3GKItiBfh4903GKT
                                                                                                                                                                                                                                                MD5:00AAFD60A0B1146274981FAB6336AFD9
                                                                                                                                                                                                                                                SHA1:20AD47ED52874202585C90FE362663F060E064D3
                                                                                                                                                                                                                                                SHA-256:5827B6A6D50CF0FB75D6BA6E36282591AD25E1F0BE636DCFC5D09BDA29A107FD
                                                                                                                                                                                                                                                SHA-512:61113AB72B7D671D7B429106709E73DB57D5B8A382680BA37A54126C7F54BC2D6B47A2584177CE6B434793546DA7EB9B8B7DF9163816DBFC67C83D9930D6A158
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Knox)]} {.. LoadTimeZoneFile America/Indiana/Knox..}..set TZData(:US/Indiana-Starke) $TZData(:America/Indiana/Knox)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Michigan

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):185
                                                                                                                                                                                                                                                Entropy (8bit):4.83459089067994
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06FQGFfXHAIg206FQJARL/iHaMCELMr4IAcGE6FQB:SlSWB9vsM3y74PFPHAIgp4KAN/iHaMHs
                                                                                                                                                                                                                                                MD5:D955A5A943B203DC4B87A91ED196B82A
                                                                                                                                                                                                                                                SHA1:C7ACC48AB2033C372C60C741F68B12FFAEA147DE
                                                                                                                                                                                                                                                SHA-256:B4E4269C4FEBFEFF26750B297A590226C0A6872519A6BFDE36F6DC3F6F756349
                                                                                                                                                                                                                                                SHA-512:445DC9A50487A4BA0A7F79078441696DCAA31F9988E5B515B5A827AC9275776B22DE303040900C1726EB99CABA8AD09E57AA674F798EA3FDEBC580E4B87D9439
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Detroit)]} {.. LoadTimeZoneFile America/Detroit..}..set TZData(:US/Michigan) $TZData(:America/Detroit)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Mountain

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                                Entropy (8bit):4.892777905787396
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/iBOlLo/4IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/iBY8/49Z
                                                                                                                                                                                                                                                MD5:E53EDD55E6448C624DD03A8A100EF5AF
                                                                                                                                                                                                                                                SHA1:1D266553CAFA23A3375CFAF7AFE6636553CC7B70
                                                                                                                                                                                                                                                SHA-256:3763BF520D3C97148C34DCFBDF70DEC2636D4E38241555900C058EFEE3BD1256
                                                                                                                                                                                                                                                SHA-512:B7FCF01DBB4231F30FEFA77C339B2CD7D984D6E6182F3BD15D6B64AC9525994E7CBF90C3F1F520FD22B54E19831B3CBAE1C22F04F60244C0C60A1809942422A4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:US/Mountain) $TZData(:America/Denver)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Pacific

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):196
                                                                                                                                                                                                                                                Entropy (8bit):4.932311644026309
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0ydJg4o3vXHAIg20ydJPyHRL/iP+e2IAcGEydJgov:SlSWB9vsM3y7DvPHAIgp5N/ip290Dy
                                                                                                                                                                                                                                                MD5:37AF94FAB52D80AF32C766644892E36D
                                                                                                                                                                                                                                                SHA1:03CE96A3B3EBFC16C9ED192DD2127FB265A7ED49
                                                                                                                                                                                                                                                SHA-256:54E5F126D4E7CC13555841A61FF66C0350621C089F475638A393930B3FB4918C
                                                                                                                                                                                                                                                SHA-512:405A7F414FA0864111E5E9F06FCA675BF4EF11FE0F82F5438416273BEF820A030A50E4D43E4E522ED79C08C0C243E9DD3692971DC912C9ADFB1BEABEB935CDDC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:US/Pacific) $TZData(:America/Los_Angeles)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\US\Samoa

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                                Entropy (8bit):4.838968615416201
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/i6A5nUDHurKeTyn:SlSWB9vsM3yciemHAIgObiecN/idXevn
                                                                                                                                                                                                                                                MD5:509CF35F5F7C9567FD19CC5C137DC070
                                                                                                                                                                                                                                                SHA1:AA5F27D36BC617A6A4107E3CA0CB0C10A71A1D9E
                                                                                                                                                                                                                                                SHA-256:E51FC51C65FFEAB514D7636271157EE8941BDACF602CBC380F5D60B5FA674E87
                                                                                                                                                                                                                                                SHA-512:E23633A16F11015F3FE2F4E675B5A60B4FDC61F8CF152FDB9BA7ED4C213B8897117721A78C5470296DAFB0FD4F0DDC019DD0DB8C28C1F1B2BE0D3A289F53D5B3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:US/Samoa) $TZData(:Pacific/Pago_Pago)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\UTC

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):153
                                                                                                                                                                                                                                                Entropy (8bit):4.844017562912325
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iLB5h8RFB:SlSWB9vsM3yzTHAIgm6N/iLfh8RX
                                                                                                                                                                                                                                                MD5:3402C8784654C24F7E956731866B833F
                                                                                                                                                                                                                                                SHA1:C34F3CCA074A50E6564B8C78683C8763B37A3002
                                                                                                                                                                                                                                                SHA-256:DEE28FF84E3FC495ED3547D5E5E9FAFDACC36A67329E747D434248ED45BF1755
                                                                                                                                                                                                                                                SHA-512:FBA2840B0FA0F084EE9840BCF56E497F8A7ABF509FA10FA66FB26BA3D80079C4F9A363577A453CD68557080EAF9DD7F1F7B5AF957B64BDA2A897B1E08C85DD19
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:UTC) $TZData(:Etc/UTC)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Universal

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):159
                                                                                                                                                                                                                                                Entropy (8bit):4.879221007428352
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iL7DJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/iL7VMr8RX
                                                                                                                                                                                                                                                MD5:5F24A249884C241D1E03D758C2641675
                                                                                                                                                                                                                                                SHA1:63AAC15A68659006F8A14FEC3F2A66B55A8AC398
                                                                                                                                                                                                                                                SHA-256:B7B0B82F471D64704E1D6F84646E6B7B2BD9CAB793FAD00F9C9B0595143C0AB7
                                                                                                                                                                                                                                                SHA-512:A7AB5E26A2C23BA296942D7C524C6EE6708A9A38CDD88022EA92E2180BC3CCFE930758FC20A24A0D271AD70733EB924B0E530FBF83CC0FC49EAD411B28503CC0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Universal) $TZData(:Etc/UTC)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\W-SU

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):172
                                                                                                                                                                                                                                                Entropy (8bit):4.999171213761279
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVwTwWXHAIgoqzTbNOARL/gIuyQauTgvn:SlSWB9vsM3ymSHAIgoXAN/gXy5n
                                                                                                                                                                                                                                                MD5:5444E85070CA2E7A52D38D6D53216B88
                                                                                                                                                                                                                                                SHA1:0F9A4FB1156312EBD0B9C81DA2164E89D21878E1
                                                                                                                                                                                                                                                SHA-256:F7DA75B585F45AB501B2889E272FF47B1C4A1D668E40AED7463EB0E8054028C2
                                                                                                                                                                                                                                                SHA-512:BBC94F98C84641392D3A4B67C152E92EDB3011DA329319ADB2485DBEAFD44DED328D80FBCA89E58687E1F0EB6BED8580BBB0075CA42284B6206A8641D76F2DE5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Moscow)]} {.. LoadTimeZoneFile Europe/Moscow..}..set TZData(:W-SU) $TZData(:Europe/Moscow)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\WET

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6945
                                                                                                                                                                                                                                                Entropy (8bit):3.7806395604065135
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:v6PgDGfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:rQbkIaFF1w0us4qE3+sSGjT
                                                                                                                                                                                                                                                MD5:1EC38B05B53ECF2DD3A90164C4693934
                                                                                                                                                                                                                                                SHA1:00900F0ADDB7526C63C67CA1662C038E95A79245
                                                                                                                                                                                                                                                SHA-256:7E6E2369C19DD19A41BE27BB8AD8DF5BE8B0096ED045C8B2C2D2F0916D494079
                                                                                                                                                                                                                                                SHA-512:47A8DAAB1B891FF09A94AF01B6673213392F70C6C1EE53D95A59D6E238FD06B0E80FA21C7279A9ADA891F5CA5B86E4D6B696EE8CFE14BFEF0ACCC9759AF1419A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:WET) {.. {-9223372036854775808 0 0 WET}.. {228877200 3600 1 WEST}.. {243997200 0 0 WET}.. {260326800 3600 1 WEST}.. {276051600 0 0 WET}.. {291776400 3600 1 WEST}.. {307501200 0 0 WET}.. {323830800 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\tzdata\Zulu

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):154
                                                                                                                                                                                                                                                Entropy (8bit):4.8800842076244715
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/taFBURFB:SlSWB9vsM3yzTHAIgm6N/YFaRX
                                                                                                                                                                                                                                                MD5:DDB6F69CA4F0EF6A708481F53F95EAB9
                                                                                                                                                                                                                                                SHA1:A63E900A9257E9D73B4BB4BACBA8133C3D1DC41B
                                                                                                                                                                                                                                                SHA-256:A06E8CCCF97CC8FB545DFDB4C89B5E5C8EDF0360547BDC1823B4AC47B1556C31
                                                                                                                                                                                                                                                SHA-512:C8EA1039BE001F5EF52662B28DBF46D02E4848F08F05923850DEA1994732037B4C8D6030B742D97FA4276AF5FEE3F17C47C7DDA4F44DD23244F9976A076D5CC4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Zulu) $TZData(:Etc/UTC)..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tcl_data\word.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5030
                                                                                                                                                                                                                                                Entropy (8bit):4.838527643033185
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:HgTQWiZuhdFQJmuldFQofsGP3R1hF9Dl19arB0E9Dl1YoaEhHe2Gu/q1ZFyJRpqk:8iZUroxvR197ABr971h5GIqrmbqIc+b/
                                                                                                                                                                                                                                                MD5:70450A0CF04EF273EFF2B070053FCFA6
                                                                                                                                                                                                                                                SHA1:47974D6C0FC986EE1273C4E13DDB9E1288CEF0FF
                                                                                                                                                                                                                                                SHA-256:678F891615E2209A8ECBA17857922A9723E78709ADB983032E89CA706000C44D
                                                                                                                                                                                                                                                SHA-512:AFD3E47324D1497CC46AC6141191FCEB843977D0B0285C807FF8985DCC56FDE10977F57D503D986CD2C1EDC6C62F01E405A0EB483340B247B129FC8D6D9FE689
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# word.tcl --..#..# This file defines various procedures for computing word boundaries in..# strings. This file is primarily needed so Tk text and entry widgets behave..# properly for different platforms...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998 Scritpics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# The following variables are used to determine which characters are..# interpreted as white space.....if {$::tcl_platform(platform) eq "windows"} {.. # Windows style - any but a unicode space char.. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\S}.. }.. if {![info exists ::tcl_nonwordchars]} {...set ::tcl_nonwordchars {\s}.. }..} else {.. # Motif style - any unicode word char (number, letter, or underscore).. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\w}.. }.. if {![info exists ::tcl_nonwordchar

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\bgerror.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8806
                                                                                                                                                                                                                                                Entropy (8bit):4.863085192885279
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:RpwYLapGk1BlM4UBIHpJFVUXUziMJ5Kxyk55qxUr7Vdk5vNR:RuYfvMdOXyj+01f
                                                                                                                                                                                                                                                MD5:C5E9A2E32AE83A79DF422D1145B692DF
                                                                                                                                                                                                                                                SHA1:08350F930FB97A95970122920C91FB9CED8329E9
                                                                                                                                                                                                                                                SHA-256:8822365EE279BEBF7A36CFDEDBA1114762F894781F4635170CC5D85FF5B17923
                                                                                                                                                                                                                                                SHA-512:71420E15A3D63329560074F6FFAD42CB464401284BC29D0DC8E34D83F8F77079F26BB4C5703E656A48E6931C3DBF6B873756FB212D0860483E0301B29EDE1212
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# bgerror.tcl --..#..#.Implementation of the bgerror procedure. It posts a dialog box with..#.the error message and gives the user a chance to see a more detailed..#.stack trace, and possible do something more interesting with that..#.trace (like save it to a log). This is adapted from work done by..#.Donal K. Fellows...#..# Copyright (c) 1998-2000 by Ajuba Solutions...# Copyright (c) 2007 by ActiveState Software Inc...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>....namespace eval ::tk::dialog::error {.. namespace import -force ::tk::msgcat::*.. namespace export bgerror.. option add *ErrorDialog.function.text [mc "Save To Log"] \...widgetDefault.. option add *ErrorDialog.function.command [namespace code SaveToLog].. option add *ErrorDialog*Label.font TkCaptionFont widgetDefault.. if {[tk windowingsystem] eq "aqua"} {...option add *ErrorDialog*background systemAlertBackgroundActi

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\button.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):21612
                                                                                                                                                                                                                                                Entropy (8bit):4.947590677310969
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:Tv7cBCAsj9oqlFFSsB3VfRt+lMpWaNwJgzCHarc6gAsj9oqlFFSsB3VlRtYlMpBz:TvweHBBTfIZxHBnZWqbJPBFIaVlCj26+
                                                                                                                                                                                                                                                MD5:AEB53F7F1506CDFDFE557F54A76060CE
                                                                                                                                                                                                                                                SHA1:EBB3666EE444B91A0D335DA19C8333F73B71933B
                                                                                                                                                                                                                                                SHA-256:1F5DD8D81B26F16E772E92FD2A22ACCB785004D0ED3447E54F87005D9C6A07A5
                                                                                                                                                                                                                                                SHA-512:ACDAD4DF988DF6B2290FC9622E8EACCC31787FECDC98DCCA38519CB762339D4D3FB344AE504B8C7918D6F414F4AD05D15E828DF7F7F68F363BEC54B11C9B7C43
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# button.tcl --..#..# This file defines the default bindings for Tk label, button,..# checkbutton, and radiobutton widgets and provides procedures..# that help in implementing those bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 2002 ActiveState Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for buttons...#-------------------------------------------------------------------------....if {[tk windowingsystem] eq "aqua"} {.... bind Radiobutton <Enter> {...tk::ButtonEnter %W.. }.. bind Radiobutton <1> {...tk::ButtonDown %W.. }.. bind Radiobutton <ButtonRelease-1> {...tk::ButtonUp %W.. }.. bind Checkbutton <Enter> {...tk::ButtonEnter %W

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\choosedir.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Nim source code, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9960
                                                                                                                                                                                                                                                Entropy (8bit):4.802555950168837
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:HKOdkMpU9YUp8UIhMYYicln9Die0luVZat3pIp5Y3sF1P8Bg8p6trIOzvKsOiCLU:HyMm9J8wPx70luex4C8Fygq6tohef+0J
                                                                                                                                                                                                                                                MD5:818E4F0112931F12B4FAC4CAD262814C
                                                                                                                                                                                                                                                SHA1:AC7060DF952F9DB52C3687B8F5E6AA4ADF06992E
                                                                                                                                                                                                                                                SHA-256:35B208E8570B0D1E0CA1C911D4FE02EE3B0CFE5667CF1BDEC006CF9D043122BA
                                                                                                                                                                                                                                                SHA-512:0C535B6621BC83412B7A64CB6AC2BA526B8E49BB5F6BC5EBEDA41D223D68DEB031DB9C8A31F8671BC5F327D720942E7FDAE3328334B0B550AC991191F96909D6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# choosedir.tcl --..#..#.Choose directory dialog implementation for Unix/Mac...#..# Copyright (c) 1998-2000 by Scriptics Corporation...# All rights reserved.....# Make sure the tk::dialog namespace, in which all dialogs should live, exists..namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}....# Make the chooseDir namespace inside the dialog namespace..namespace eval ::tk::dialog::file::chooseDir {.. namespace import -force ::tk::msgcat::*..}....# ::tk::dialog::file::chooseDir:: --..#..#.Implements the TK directory selection dialog...#..# Arguments:..#.args..Options parsed by the procedure...#..proc ::tk::dialog::file::chooseDir:: {args} {.. variable ::tk::Priv.. set dataName __tk_choosedir.. upvar ::tk::dialog::file::$dataName data.. Config $dataName $args.... if {$data(-parent) eq "."} {.. set w .$dataName.. } else {.. set w $data(-parent).$dataName.. }.... # (re)create the dialog box if necessary.. #.. if {![winfo exis

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\clrpick.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):22103
                                                                                                                                                                                                                                                Entropy (8bit):5.03166227244502
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:lJGidpe3JQDUd6hgp6EQstzQf+a9DPbS43/H//cO802UeeVnZmM6BA0kyVJv9Qpu:Gep6JCwQDPbLPaRCzTdMAe
                                                                                                                                                                                                                                                MD5:AD86E0265C307348A16E9E4B64D8F235
                                                                                                                                                                                                                                                SHA1:66EC6726DF997EE6096F642EBBBDB8C3201BA571
                                                                                                                                                                                                                                                SHA-256:D210DCFA9ADB4C23E44EBF744839158CAB4E21EACF9483C6BA91BA6EC4660EB8
                                                                                                                                                                                                                                                SHA-512:A0C9DF815FE54C26EED69C84B29FD829EB1B7E43D2787E98C71D091607226532F6F0E9213E83FF8263FCB6DA892178029D5EF475FD46D22F9BB8AB31B87BF438
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# clrpick.tcl --..#..#.Color selection dialog for platforms that do not support a..#.standard color selection dialog...#..# Copyright (c) 1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#..# ToDo:..#..#.(1): Find out how many free colors are left in the colormap and..#. don't allocate too many colors...#.(2): Implement HSV color selection...#....# Make sure namespaces exist..namespace eval ::tk {}..namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::color {.. namespace import ::tk::msgcat::*..}....# ::tk::dialog::color:: --..#..#.Create a color dialog and let the user choose a color. This function..#.should not be called directly. It is called by the tk_chooseColor..#.function when a native color selector widget does not exist..#..proc ::tk::dialog::color:: {args} {.. variable ::tk::Priv.. set dataName __tk__color.. upvar ::tk::dialog::color::$da

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\comdlg.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8690
                                                                                                                                                                                                                                                Entropy (8bit):5.098389551322902
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:u4R7+/gFw/MEN55fO7eyjt4bjC+gR8e3vwLln/+LVtUw0tXK4jA:u4l+/gFeMI55Xyjt4bjC+gOe3Ih/+LV1
                                                                                                                                                                                                                                                MD5:ABF277E4F62423F4345B6AD65640B8C2
                                                                                                                                                                                                                                                SHA1:E66A4E37D51C7827C9ACA449A42E0966AACBC8C8
                                                                                                                                                                                                                                                SHA-256:C7DA292CCF5F413E599C3491C331FFD58CF273F8477FACB097E6F36CF1F32A08
                                                                                                                                                                                                                                                SHA-512:AA9F75D7C5C915B5FCD2F454856D080D186AB9BA149DC139FEAF7F4AC3DC51E6769E138E3B1BE45B3FEC3AE744189DE44DB2B748F0628FF13E4E733B9CD68BD5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# comdlg.tcl --..#..#.Some functions needed for the common dialog boxes. Probably need to go..#.in a different file...#..# Copyright (c) 1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# tclParseConfigSpec --..#..#.Parses a list of "-option value" pairs. If all options and..#.values are legal, the values are stored in..#.$data($option). Otherwise an error message is returned. When..#.an error happens, the data() array may have been partially..#.modified, but all the modified members of the data(0 array are..#.guaranteed to have valid values. This is different than..#.Tk_ConfigureWidget() which does not modify the value of a..#.widget record if any error occurs...#..# Arguments:..#..# w = widget record to modify. Must be the pathname of a widget...#..# specs = {..# {-commandlineswitch resourceName ResourceClass defaultValue verifier}..# {....}..# }..#..# flags

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\console.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):33347
                                                                                                                                                                                                                                                Entropy (8bit):4.995865221021151
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:jMpwGU6OGEJemVueuR3fitsHI76Su6qKQjGCy1HyOnmTTRV+po2mBh6S5mDjbHqC:jMpdUDGEJpC6+oVeKQPjnD2jVfV/
                                                                                                                                                                                                                                                MD5:4CA2E90A125FFD6191D0C5AC6818D18F
                                                                                                                                                                                                                                                SHA1:855F10234FA1D65521C2508206EA58DC565E452B
                                                                                                                                                                                                                                                SHA-256:A4B21DBF699C20EA5AC334EC109F731BE8EB2B8F9A34CCC2EBE538F4BF8A05F8
                                                                                                                                                                                                                                                SHA-512:ED5AE05A7F1D379F8343FF4AD7EF561C5C4D9B7E02399A7281DF8B8930B924B0482FDC5B4E3F90C2214ADA4F87D9A5E64DB2259194C58A2135D969C01BBE64F9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# console.tcl --..#..# This code constructs the console window for an application. It..# can be used by non-unix systems that do not have built-in support..# for shells...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...# Copyright (c) 2007-2008 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# TODO: history - remember partially written command....namespace eval ::tk::console {.. variable blinkTime 500 ; # msecs to blink braced range for.. variable blinkRange 1 ; # enable blinking of the entire braced range.. variable magicKeys 1 ; # enable brace matching and proc/var recognition.. variable maxLines 600 ; # maximum # of lines buffered in console.. variable showMatches 1 ; # show multiple expand matches.. variable useFontchooser [llength [info command ::tk::fontchooser]

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\dialog.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5988
                                                                                                                                                                                                                                                Entropy (8bit):4.829498876074983
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:qFR55woFFEciKwKClFEOTIhDHWyzaoj9zza7v0J7:qL55jiKwKCzTIhDbzaojhSG7
                                                                                                                                                                                                                                                MD5:B2B3AA971D42FDBF92F13B45111EE1D3
                                                                                                                                                                                                                                                SHA1:A74F2C2707463D6E209D0E0C96D75083AC6920A5
                                                                                                                                                                                                                                                SHA-256:1C977052C1D8293CC5FE4198A538BECA9BC821AF85E76E4EEFBFB75B33CE8BED
                                                                                                                                                                                                                                                SHA-512:146F658DA3E6E9176FA51C9836D7C1DCFC14E148A26B224155F6493C195A7FB20C2DC4EE21994E5A193B8DA8561C75374E830304F94F0C844E52AD829F6810D5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# dialog.tcl --..#..# This file defines the procedure tk_dialog, which creates a dialog..# box containing a bitmap, a message, and one or more buttons...#..# Copyright (c) 1992-1993 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#..# ::tk_dialog:..#..# This procedure displays a dialog box, waits for a button in the dialog..# to be invoked, then returns the index of the selected button. If the..# dialog somehow gets destroyed, -1 is returned...#..# Arguments:..# w -..Window to use for dialog top-level...# title -.Title to display in dialog's decorative frame...# text -.Message to display in dialog...# bitmap -.Bitmap to display in dialog (empty string means none)...# default -.Index of button that is to display the default ring..#..(-1 means none)...# args -.One or more strings to display in buttons

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\entry.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):18440
                                                                                                                                                                                                                                                Entropy (8bit):4.982597499983157
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:mDfyPIlBk3yrt8qLjtpa+qh+rA4rsWRWrrMUtCPnkKYNlPp64ZnCD:mDfyPIlBk3yJ8mtpaplcp6o
                                                                                                                                                                                                                                                MD5:007F42FBCDC57652AC8381F11AF7FB67
                                                                                                                                                                                                                                                SHA1:1BB1B0FCAD6F5633D1BEB8903112F180B1C4BA7F
                                                                                                                                                                                                                                                SHA-256:65BA33A1E0B21E8E074780A51189CEE6FD9926C85273E9E7633987FC212A17B2
                                                                                                                                                                                                                                                SHA-512:A27089719ADAFC48B5ABB905E40D0C6A0A2507526223D72C1CFF36AB7C15362C6F0B8EE5775181BA1730852802AFA64631EE3720E624B630E3274BFB32F6A59A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# entry.tcl --..#..# This file defines the default bindings for Tk entry widgets and provides..# procedures that help in implementing those bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#...start dragging out a selection)...# pressX -..X-coordinate at which the mouse button was pressed...# selectMode -..The style of selection currently underway:..#...char, word

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\focus.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5035
                                                                                                                                                                                                                                                Entropy (8bit):4.819523401259934
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:J3MRZZ7HWb/6OgRKjtS6Mn9GRZZ7HWb2Y6aO6R5nh76SMoB2kd82KtTpsi2D0DSn:CRZdPul1RZdFaRf0XoB2gZKZpsi2pn
                                                                                                                                                                                                                                                MD5:63B219BE9AFF1DE7DE2BAF0E941CAE38
                                                                                                                                                                                                                                                SHA1:A2FEBB31380E12FF01E6F641FE8B4F815941462F
                                                                                                                                                                                                                                                SHA-256:8872F236D7E824AEC0ACD4BACC00FDD7EC9BC5534814ECF2160610C10647B7C5
                                                                                                                                                                                                                                                SHA-512:057700F8FDE4B7C3D7AB7CEFD6C531060BF2B1B3B727CAD6A37ECD42EBC557765D94B83ADD438BD5AFA1F6F919D80AE755A8D98918981167B871F31AD42FDF5E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# focus.tcl --..#..# This file defines several procedures for managing the input..# focus...#..# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_focusNext --..# This procedure returns the name of the next window after "w" in..# "focus order" (the window that should receive the focus next if..# Tab is typed in w). "Next" is defined by a pre-order search..# of a top-level and its non-top-level descendants, with the stacking..# order determining the order of siblings. The "-takefocus" options..# on windows determine whether or not they should be skipped...#..# Arguments:..# w -..Name of a window.....proc ::tk_focusNext w {.. set cur $w.. while {1} {.....# Descend to just before the first child of the current widget......set parent $cur...set children [winfo children $cur]...set i -1.....# Look for the next sibling that isn't a top-leve

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\fontchooser.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):18232
                                                                                                                                                                                                                                                Entropy (8bit):4.723225284452692
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:NoRqdguMCeor/4VxgU80zNxWHKVozN5EaKdhsbyM:NoRqdguMCeor/4VxgUnzN0KSDEk
                                                                                                                                                                                                                                                MD5:CFA99C2D3F02AE6538809774699A9CE7
                                                                                                                                                                                                                                                SHA1:DADB7B3D1D9531710BA7D3025CE18F6F8149F280
                                                                                                                                                                                                                                                SHA-256:4EE521F4980A5056077005B748717D91CB6B17342CDD20135962AB92A665B580
                                                                                                                                                                                                                                                SHA-512:DCF54AAEA439C986AE28CEC0241F204BB5001DE4E98C2E7A9C282F9E47747AD62E9B2CF6FBBAC068BF1F1BB0AAC866F85476E9EE79935CE1E3656F122C2D002D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# fontchooser.tcl -..#..#.A themeable Tk font selection dialog. See TIP #324...#..# Copyright (C) 2008 Keith Vetter..# Copyright (C) 2008 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::fontchooser {.. variable S.... set S(W) .__tk__fontchooser.. set S(fonts) [lsort -dictionary -unique [font families]].. set S(styles) [list \.. [::msgcat::mc Regular] \.. [::msgcat::mc Italic] \.. [::msgcat::mc Bold] \.. [::msgcat::mc {Bold Italic}] \.. ].. set S(sizes) {8 9 10 11 12 14 16 18 20 22 24 26 28 36 48 72}.. set S(strike) 0.. set S(under) 0.. set S(first) 1.. set S(-parent) ... set S(-title) {}.. set S(-command) "".. set S(-font) TkDefaultFont.. set S(bad) [list ]..}....proc ::tk::fontchooser::Canonical {} {.. variable S.... foreach style $S(styles

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\iconlist.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):17565
                                                                                                                                                                                                                                                Entropy (8bit):4.959816621842895
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:FNP8nO9Wo8k5NfQH8EsOy8WMdbffNCvHshPOw7jW:FNf8uNfQH89Z8WMdz1vDW
                                                                                                                                                                                                                                                MD5:FDB839B85C4CEB34DEC04E0EBD6A3C96
                                                                                                                                                                                                                                                SHA1:0FD8981093CC6ED9927D1DDE708FECE84B9C5E6F
                                                                                                                                                                                                                                                SHA-256:07812124D27E47621AF74FDB90C777D3219B02F657FC2F97F606C69EF9468A01
                                                                                                                                                                                                                                                SHA-512:E65616B3F6BDC3910FC90E9710426370AA4B0A0D9EB6289871B9C30A98A2F2B5CC1E471B63203210AAE89120F20F164A33E01DA45BCCCCCEC7BFC1CCFD70FAC7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# iconlist.tcl..#..#.Implements the icon-list megawidget used in the "Tk" standard file..#.selection dialog boxes...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...# Copyright (c) 2009 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#..# API Summary:..#.tk::IconList <path> ?<option> <value>? .....#.<path> add <imageName> <itemList>..#.<path> cget <option>..#.<path> configure ?<option>? ?<value>? .....#.<path> deleteall..#.<path> destroy..#.<path> get <itemIndex>..#.<path> index <index>..#.<path> invoke..#.<path> see <index>..#.<path> selection anchor ?<int>?..#.<path> selection clear <first> ?<last>?..#.<path> selection get..#.<path> selection includes <item>..#.<path> selection set <first> ?<last>?.....package require Tk....::tk::Megawidget create ::tk::IconList ::tk::FocusableWidget {.. variable w canvas sbar accel accelCB fill font index \...itemList itemsPerColumn list

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\icons.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11037
                                                                                                                                                                                                                                                Entropy (8bit):6.048349526382653
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:0nEPytJLl1S47T3YqN5/vkJpnhXqBB4aw2rqZiygTtYTpOq/pc75Mk:xqLz7F5KTqBBLuZ1gTSsqhk
                                                                                                                                                                                                                                                MD5:995A0A8F7D0861C268AEAD5FC95A42EA
                                                                                                                                                                                                                                                SHA1:21E121CF85E1C4984454237A646E58EC3C725A72
                                                                                                                                                                                                                                                SHA-256:1264940E62B9A37967925418E9D0DC0BEFD369E8C181B9BAB3D1607E3CC14B85
                                                                                                                                                                                                                                                SHA-512:DB7F5E0BC7D5C5F750E396E645F50A3E0CDE61C9E687ADD0A40D0C1AA304DDFBCEEB9F33AD201560C6E2B051F2EDED07B41C43D00F14EE435CDEEE73B56B93C7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# icons.tcl --..#..#.A set of stock icons for use in Tk dialogs. The icons used here..#.were provided by the Tango Desktop project which provides a..#.unified set of high quality icons licensed under the..#.Creative Commons Attribution Share-Alike license..#.(https://creativecommons.org/licenses/by-sa/3.0/)..#..#.See http://tango.freedesktop.org/Tango_Desktop_Project..#..# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>....namespace eval ::tk::icons {}....image create photo ::tk::icons::warning -data {.. iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAABSZJREFU.. WIXll1toVEcYgL+Zc87u2Yu7MYmrWRuTJuvdiMuqiJd4yYKXgMQKVkSjFR80kFIVJfWCWlvpg4h9.. 8sXGWGof8iKNICYSo6JgkCBEJRG8ImYThNrNxmaTeM7pQ5IlJkabi0/9YZhhZv7///4z/8zPgf+7.. KCNRLgdlJijXwRyuDTlcxV9hbzv8nQmxMjg+XDtiOEplkG9PSfkztGmTgmFQd+FCVzwa3fYN/PHZ.. AcpBaReicW5xcbb64IEQqko8Lc26d/58cxS+/BY6hmJvyEfQBoUpwWCmW1FErKaGWHU13uRk4QkE.. UtxQNFR7QwIoB4eiKD9PWbVKbb10CZmaCqmpxCormRYO26QQx85B0mcD+AeK0

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\README

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):329
                                                                                                                                                                                                                                                Entropy (8bit):4.3973643486226655
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:nVxpJFBmHdeA1xNZgk0dIf3Ju4dFi6/XWrWhr3W7FxmVFraazmVAJFKyVQR7icr8:nj5Bqf1fZgp6A4FDG6dm7FUGAJVVMRmn
                                                                                                                                                                                                                                                MD5:921245A21F7E783997DC7B859AF1B65B
                                                                                                                                                                                                                                                SHA1:2EFE3C8F70CF18621006890BF21CC097770D140D
                                                                                                                                                                                                                                                SHA-256:C6DB098EBD8A622164D37D4AB0A8C205DB1A83AC3065D5CDE3CB5FB61925D283
                                                                                                                                                                                                                                                SHA-512:CAD823FF3D13A64C00825961E75B5133690556FB1F622834F8B1DF316A9E75BABB63B9F5148DAE7B1391123B4C8D55B4B8B2EB6F8E6E1DA9DE02A5BD7AC0FD6F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:README - images directory....This directory includes images for the Tcl Logo and the Tcl Powered..Logo. Please feel free to use the Tcl Powered Logo on any of your..products that employ the use of Tcl or Tk. The Tcl logo may also be..used to promote Tcl in your product documentation, web site or other..places you so desire...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\logo.eps

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):34991
                                                                                                                                                                                                                                                Entropy (8bit):5.248845410801251
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:0YrY6a0v4uIqYMEKjodQKOfRXMLcSqDGpfTKFVm3AsanMEDzzBHWzaw7XUbTJjoB:0YrY6aeIqYMEKjouzfRXMLcSqDGpfTKo
                                                                                                                                                                                                                                                MD5:23C4EDED40DEC065F99E6653AEE1BB31
                                                                                                                                                                                                                                                SHA1:3175E261BE198731DEDB07264CCB84C8DEDF7967
                                                                                                                                                                                                                                                SHA-256:76207D8DFDE189A29DC0E76ADB7EAAA606B96BC6C1C831F34D1C85B1C5B51DD3
                                                                                                                                                                                                                                                SHA-512:BA139A64BE72BB681040924C4294E2726BA5AB243E805E60A854D2D23E154705E2431D1AB2DE732BFA393747FD30D8A5C913895CBE1463DBF50CC23CAE5B0454
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL/TK LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:58 PM)..%%BoundingBox: 251 331 371 512..%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%DocumentCustomColors: (TCL RED)..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe Illustrator

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\logo100.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 68 x 100
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2341
                                                                                                                                                                                                                                                Entropy (8bit):6.9734417899888665
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
                                                                                                                                                                                                                                                MD5:FF04B357B7AB0A8B573C10C6DA945D6A
                                                                                                                                                                                                                                                SHA1:BCB73D8AF2628463A1B955581999C77F09F805B8
                                                                                                                                                                                                                                                SHA-256:72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
                                                                                                                                                                                                                                                SHA-512:10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......*\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~*].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\logo64.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 43 x 64
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1670
                                                                                                                                                                                                                                                Entropy (8bit):6.326462043862671
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
                                                                                                                                                                                                                                                MD5:B226CC3DA70AAB2EBB8DFFD0C953933D
                                                                                                                                                                                                                                                SHA1:EA52219A37A140FD98AEA66EA54685DD8158D9B1
                                                                                                                                                                                                                                                SHA-256:138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
                                                                                                                                                                                                                                                SHA-512:3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\logoLarge.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 354 x 520
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11000
                                                                                                                                                                                                                                                Entropy (8bit):7.88559092427108
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
                                                                                                                                                                                                                                                MD5:45D9B00C4CF82CC53723B00D876B5E7E
                                                                                                                                                                                                                                                SHA1:DDD10E798AF209EFCE022E97448E5EE11CEB5621
                                                                                                                                                                                                                                                SHA-256:0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
                                                                                                                                                                                                                                                SHA-512:6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......*\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.*^.x.....J.L.!.'........=+eZ..i..ynF.8...].y|..m.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\logoMed.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 87a, 120 x 181
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3889
                                                                                                                                                                                                                                                Entropy (8bit):7.425138719078912
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
                                                                                                                                                                                                                                                MD5:BD12B645A9B0036A9C24298CD7A81E5A
                                                                                                                                                                                                                                                SHA1:13488E4F28676F1E0CE383F80D13510F07198B99
                                                                                                                                                                                                                                                SHA-256:4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
                                                                                                                                                                                                                                                SHA-512:F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.*&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..*K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\pwrdLogo.eps

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):29706
                                                                                                                                                                                                                                                Entropy (8bit):5.33387357427899
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:0warY6a0v4uIqYMEKjodQKOfRtMLcSqDGpf88KFVmlhEtOI/eE7U0a1:03rY6aeIqYMEKjouzfRtMLcSqDGpfbKc
                                                                                                                                                                                                                                                MD5:4AE11820D4D592D02CDE458E6F8CE518
                                                                                                                                                                                                                                                SHA1:A2E8D3D6191B336D43E48A65C3AE6485B07D93C6
                                                                                                                                                                                                                                                SHA-256:87FD9E46DBB5F2BF1529AFB411182C9FB9C58E23D830C66A233AF0C256BB8EFF
                                                                                                                                                                                                                                                SHA-512:E0AD4ED570D414BF00931B0F5BBB61FEF981ABDB22ECC42F8E9841905D38874CDFE38F22EDB17ACD0F7539B2932F9C4A865FA73A49BB1458CE05EE10A78BE357
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL PWRD LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:59 PM)..%%BoundingBox: 242 302 377 513..%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe I

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\pwrdLogo100.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 64 x 100
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1615
                                                                                                                                                                                                                                                Entropy (8bit):7.461273815456419
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
                                                                                                                                                                                                                                                MD5:DBFAE61191B9FADD4041F4637963D84F
                                                                                                                                                                                                                                                SHA1:BD971E71AE805C2C2E51DD544D006E92363B6C0C
                                                                                                                                                                                                                                                SHA-256:BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
                                                                                                                                                                                                                                                SHA-512:ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8O*Z.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.|..pf!..&.......8.#.8.....*..J>. .t..h6(........#..0.A...*!..)...x..u.Z....*%..H.....*.......`......|.....1.......&.....T*...f.l...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\pwrdLogo150.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 97 x 150
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2489
                                                                                                                                                                                                                                                Entropy (8bit):7.708754027741608
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
                                                                                                                                                                                                                                                MD5:711F4E22670FC5798E4F84250C0D0EAA
                                                                                                                                                                                                                                                SHA1:1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
                                                                                                                                                                                                                                                SHA-256:5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
                                                                                                                                                                                                                                                SHA-512:220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\pwrdLogo175.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 113 x 175
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2981
                                                                                                                                                                                                                                                Entropy (8bit):7.758793907956808
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
                                                                                                                                                                                                                                                MD5:DA5FB10F4215E9A1F4B162257972F9F3
                                                                                                                                                                                                                                                SHA1:8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
                                                                                                                                                                                                                                                SHA-256:62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
                                                                                                                                                                                                                                                SHA-512:990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....*0p}..KP?c.\@KW.S(..M..B.....-q...S2...*.,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.*4..(........*..F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\pwrdLogo200.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 130 x 200
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3491
                                                                                                                                                                                                                                                Entropy (8bit):7.790611381196208
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
                                                                                                                                                                                                                                                MD5:A5E4284D75C457F7A33587E7CE0D1D99
                                                                                                                                                                                                                                                SHA1:FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
                                                                                                                                                                                                                                                SHA-256:BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
                                                                                                                                                                                                                                                SHA-512:4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R...*...J.p.A.t.*..$A*...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y1*35.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. ...*..Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'|..M9..."...,*.......

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\pwrdLogo75.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 48 x 75
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1171
                                                                                                                                                                                                                                                Entropy (8bit):7.289201491091023
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
                                                                                                                                                                                                                                                MD5:7013CFC23ED23BFF3BDA4952266FA7F4
                                                                                                                                                                                                                                                SHA1:E5B1DED49095332236439538ECD9DD0B1FD4934B
                                                                                                                                                                                                                                                SHA-256:462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
                                                                                                                                                                                                                                                SHA-512:A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N|...f..J.x... P&.|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\images\tai-ku.gif

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 100 x 100
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5473
                                                                                                                                                                                                                                                Entropy (8bit):7.754239979431754
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
                                                                                                                                                                                                                                                MD5:048AFE69735F6974D2CA7384B879820C
                                                                                                                                                                                                                                                SHA1:267A9520C4390221DCE50177E789A4EBD590F484
                                                                                                                                                                                                                                                SHA-256:E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
                                                                                                                                                                                                                                                SHA-512:201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa....*.p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......Ef*Y3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\license.terms

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2307
                                                                                                                                                                                                                                                Entropy (8bit):5.135743409565932
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:XU/zAcKT6yOCaDBfsHLk32s3J5w83KDyP1BXy3JQz7yuC:XNc+92sg3A8uyDXy3JQnDC
                                                                                                                                                                                                                                                MD5:F090D9B312C16489289FD39813412164
                                                                                                                                                                                                                                                SHA1:1BEC6668F6549771DADC67D153B89B8F77DCD4B9
                                                                                                                                                                                                                                                SHA-256:0D1E4405F6273F091732764ED89B57066BE63CE64869BE6C71EA337DC4F2F9B5
                                                                                                                                                                                                                                                SHA-512:57B323589C5A8D9CBB224416731D8CE65C4B94146DF15CE30885DF63B1D0B3F709093B65390A911F84F20B7C5DE3C0AF9B4D7D531742BE046EDA6E8C3432EF6E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:This software is copyrighted by the Regents of the University of..California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState..Corporation, Apple Inc. and other parties. The following terms apply to..all files associated with the software unless explicitly disclaimed in..individual files.....The authors hereby grant permission to use, copy, modify, distribute,..and license this software and its documentation for any purpose, provided..that existing copyright notices are retained in all copies and that this..notice is included verbatim in any distributions. No written agreement,..license, or royalty fee is required for any of the authorized uses...Modifications to this software may be copyrighted by their authors..and need not follow the licensing terms described here, provided that..the new terms are clearly indicated on the first page of each file where..they apply.....IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY..FOR DIRECT, INDIRECT, SPECIAL, INCI

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\listbox.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):15255
                                                                                                                                                                                                                                                Entropy (8bit):4.9510475386072095
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
                                                                                                                                                                                                                                                MD5:804E6DCE549B2E541986C0CE9E75E2D1
                                                                                                                                                                                                                                                SHA1:C44EE09421F127CF7F4070A9508F22709D06D043
                                                                                                                                                                                                                                                SHA-256:47C75F9F8348BF8F2C086C57B97B73741218100CA38D10B8ABDF2051C95B9801
                                                                                                                                                                                                                                                SHA-512:029426C4F659848772E6BB1D8182EB03D2B43ADF68FCFCC1EA1C2CC7C883685DEDA3FFFDA7E071912B9BDA616AD7AF2E1CB48CE359700C1A22E1E53E81CAE34B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# listbox.tcl --..#..# This file defines the default bindings for Tk listbox widgets..# and provides procedures that help in implementing those bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....#--------------------------------------------------------------------------..# tk::Priv elements used in this file:..#..# afterId -..Token returned by "after" for autoscanning...# listboxPrev -.The last element to be selected or deselected..#...during a selection operation...# listboxSelection -.All of the items that were selected before the..#...current selection operation (such as a mouse..#...drag) started; used to cancel an operation...#--------------------------------------------------------------------------....#--------------

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\megawidget.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9862
                                                                                                                                                                                                                                                Entropy (8bit):4.786615174847384
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
                                                                                                                                                                                                                                                MD5:D83ED6AC2912900040530528A0237AB3
                                                                                                                                                                                                                                                SHA1:2D18E42A8B96C3D71C1C6701010FDF75C1E6D5D8
                                                                                                                                                                                                                                                SHA-256:848258B946C002E2696CA3815A1589C8120AF5CC41FBC11BBD9A3F5754CC21AF
                                                                                                                                                                                                                                                SHA-512:00B4CD0D58029FC37820C163A4AE1DEAD22FB5C767BDC118659EACE26D449C362189611DFB3FAB1AC129FABFEC2CE853EA2C10D418FAE5AEB91DDC9330FF782D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# megawidget.tcl..#..#.Basic megawidget support classes. Experimental for any use other than..#.the ::tk::IconList megawdget, which is itself only designed for use in..#.the Unix file dialogs...#..# Copyright (c) 2009-2010 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....package require Tk.....::oo::class create ::tk::Megawidget {.. superclass ::oo::class.. method unknown {w args} {...if {[string match .* $w]} {... [self] create $w {*}$args... return $w...}...next $w {*}$args.. }.. unexport new unknown.. self method create {name superclasses body} {...next $name [list \....superclass ::tk::MegawidgetClass {*}$superclasses]\;$body.. }..}....::oo::class create ::tk::MegawidgetClass {.. variable w hull options IdleCallbacks.. constructor args {...# Extract the "widget name" from the object name...set w [namespace tail [self]].....# Configure things...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\menu.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):39790
                                                                                                                                                                                                                                                Entropy (8bit):4.915612301723047
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:NKJsO8O4IzOQjJwxzire5pKVjriecYyq4CpKgnP:NKJsO8iOQizire54lriecYf40
                                                                                                                                                                                                                                                MD5:B7DAA21C1C192B8CB5B86CBD7B2CE068
                                                                                                                                                                                                                                                SHA1:AE8ABF9017F37CCDF5D0D15DE66BB124A7482BA0
                                                                                                                                                                                                                                                SHA-256:312AF944A276CDBF1EE00757EF141595670984F7F13E19922C25643A040F5339
                                                                                                                                                                                                                                                SHA-512:B619E3B8BE5EC4545E97B7A7A7F7FECC2AAFA58438F9CA3819F644720CF5FF5C44DA12AC25988570E595D97CAD799F87D93C24D5E67A7A953B9F5312952FBEB6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# menu.tcl --..#..# This file defines the default bindings for Tk menus and menubuttons...# It also implements keyboard traversal of menus and implements a few..# other utility procedures related to menus...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# cursor -..Saves the -cursor option for the posted menubutton...# focus -..Saves the focus during a menu selection operation...#...Focus gets restored here when the menu is unposted...# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if..#...tk::Priv(oldGrab) is non

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\mkpsenc.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):30840
                                                                                                                                                                                                                                                Entropy (8bit):5.142909056222569
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
                                                                                                                                                                                                                                                MD5:983C7B78F1A0EBACAB8006D391A01FCD
                                                                                                                                                                                                                                                SHA1:7EA37474EA039ED7A37BFDD7D76EAE673E666283
                                                                                                                                                                                                                                                SHA-256:C5BDCA3ABA671F03DC4624AB5FD260490F5002491D6C619142CCF5A1A744528A
                                                                                                                                                                                                                                                SHA-512:A006EF9B7213E572F6FC540D1512A52C52FEC44E3A07846DE09662AE32B7191C5CF639798531847B39E4076BF9DD6314B6F5373065C04F4FEF221185B39C3117
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# mkpsenc.tcl --..#..# This file generates the postscript prolog used by Tk.....namespace eval ::tk {.. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically.. # handle any 8-bit encoding, but Tk never generates characters outside.. # ASCII)... #.. proc CreatePostscriptEncoding {} {...variable psglyphs...# Now check for known. Even if it is known, it can be other than we...# need. GhostScript seems to be happy with such approach...set result "\[\n"...for {set i 0} {$i<256} {incr i 8} {... for {set j 0} {$j<8} {incr j} {....set enc [encoding convertfrom "iso8859-1" \.....[format %c [expr {$i+$j}]]]....catch {.... set hexcode {}.... set hexcode [format %04X [scan $enc %c]]....}....if {[info exists psglyphs($hexcode)]} {.... append result "/$psglyphs($hexcode)"....} else {.... append result "/space"....}... }... append result "\n"...}...append result "\]"...return $result.. }.... # List of adobe glyph names. Converted from glyph

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgbox.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:xbm image (32x, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):16786
                                                                                                                                                                                                                                                Entropy (8bit):4.717927930017041
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
                                                                                                                                                                                                                                                MD5:217087AB6B2A8F9D7252E311D69C3769
                                                                                                                                                                                                                                                SHA1:09AEB2BC5B7C7F4AB3DE4211D786C519AE0970F6
                                                                                                                                                                                                                                                SHA-256:A07E3A3809CED3C6C9C1E171DCA5AD1F28357734CD41B2B9DD9F58085B3D2842
                                                                                                                                                                                                                                                SHA-512:6E57633C924BFC16D380C014C20DD24D5727E70D4843FCEC4D7995B4DB21941EA8F2A5FD6E5386DF3364B6905D4D66B2B9595DC8FC70CFF40A2D49A92A1B6FBA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# msgbox.tcl --..#..#.Implements messageboxes for platforms that do not have native..#.messagebox support...#..# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# Ensure existence of ::tk::dialog namespace..#..namespace eval ::tk::dialog {}....image create bitmap ::tk::dialog::b1 -foreground black \..-data "#define b1_width 32\n#define b1_height 32..static unsigned char q1_bits[] = {.. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,.. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,.. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x04, 0x00,

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\cs.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4235
                                                                                                                                                                                                                                                Entropy (8bit):4.789130604359491
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nlw9Twd+j3gLhokqwX+hTnJgNanPNcgRhgP+5QPwJJENL:nlw9TjjwI3hTnJgNaRhgP75L
                                                                                                                                                                                                                                                MD5:5A8B46B85DCCBF74E2B5B820E1A7B9D1
                                                                                                                                                                                                                                                SHA1:980F4FC5BABA82BA0FE02F9BD03A23DF6D565BB1
                                                                                                                                                                                                                                                SHA-256:4DFFBEEDBF0D66D84B13088016D1A782CEAAD4DED27BE1E38842F8969C0E533F
                                                                                                                                                                                                                                                SHA-512:2D81FC06CF3C20E4F6314BD13AF81FDE38A9B06510584C84C6A0C8C36314F980F77D02BD8056E7EE5DE599A0620E0C0349124147334B9C141145270046B19D90
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it".. ::msgcat::mcset cs "&About..." "&O programu...".. ::msgcat::mcset cs "All Files" "V\u0161echny soubory".. ::msgcat::mcset cs "Application Error" "Chyba programu".. ::msgcat::mcset cs "Bold Italic".. ::msgcat::mcset cs "&Blue" "&Modr\341".. ::msgcat::mcset cs "Cancel" "Zru\u0161it".. ::msgcat::mcset cs "&Cancel" "&Zru\u0161it".. ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.".. ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e".. ::msgcat::mcset cs "Cl&ear" "Sma&zat".. ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu".. ::msgcat::mcset cs "Color" "Barva".. ::msgcat::mcset cs "Console" "Konzole".. ::msgcat::mcset cs "&Copy" "&Kop\355rovat".. ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout".. ::msgcat::mcset cs "&

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\da.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3987
                                                                                                                                                                                                                                                Entropy (8bit):4.651948695787255
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nRZ2uDMr05sIEzs2KkrT+XuTKN0FjDDP9:nRZzDy4kBKkrT+QpP9
                                                                                                                                                                                                                                                MD5:227B0F255F854460E8E5146ED7A17B85
                                                                                                                                                                                                                                                SHA1:99A080CAD631F21963C51A5B254BDAD3724DC866
                                                                                                                                                                                                                                                SHA-256:FEEF8F8AD33BB3362C845A25D6ED273C398051047D899B31790474614C7AFD2D
                                                                                                                                                                                                                                                SHA-512:36A4B48831316CC29686CC76DA00110EB078EC56F55A960D11AE427AA3D913C340C1E3805BF2AD40C1A8A92FC6587DA5D2C245E7501289FC3E228BE14FE49598
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset da "&Abort" "&Afbryd".. ::msgcat::mcset da "&About..." "&Om...".. ::msgcat::mcset da "All Files" "Alle filer".. ::msgcat::mcset da "Application Error" "Programfejl".. ::msgcat::mcset da "&Blue" "&Bl\u00E5".. ::msgcat::mcset da "Cancel" "Annuller".. ::msgcat::mcset da "&Cancel" "&Annuller".. ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.".. ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog".. ::msgcat::mcset da "Cl&ear" "&Ryd".. ::msgcat::mcset da "&Clear Console" "&Ryd konsolen".. ::msgcat::mcset da "Color" "Farve".. ::msgcat::mcset da "Console" "Konsol".. ::msgcat::mcset da "&Copy" "&Kopier".. ::msgcat::mcset da "Cu&t" "Kli&p".. ::msgcat::mcset da "&Delete" "&Slet".. ::msgcat::mcset da "Details >>" "Detailer".. ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" finde

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\de.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4914
                                                                                                                                                                                                                                                Entropy (8bit):4.6221938909259475
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:nxLEpatioUqGBLbz4ME/XKKVN9R7S/0oYr9:epY3MkXKKxRu2r9
                                                                                                                                                                                                                                                MD5:2203F65BCDA61BC15AEAC4F868C6D94A
                                                                                                                                                                                                                                                SHA1:C4CC3975679D23892406E4E8971359A0775B1B86
                                                                                                                                                                                                                                                SHA-256:C0F574B14068A049E93421C73873D750C98DE28B7B77AA42FE72CBE0270A4186
                                                                                                                                                                                                                                                SHA-512:79F134FDAD3B12524D43BF9F59D3C04CAE30A95F591A51B82C8DF7CC8563BEA5D464AEECC457D9F60C04365E30459C447ED537AFC832BA25E1815DE06C2B81E5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset de "&Abort" "&Abbruch".. ::msgcat::mcset de "&About..." "&\u00dcber...".. ::msgcat::mcset de "All Files" "Alle Dateien".. ::msgcat::mcset de "Application Error" "Applikationsfehler".. ::msgcat::mcset de "&Apply" "&Anwenden".. ::msgcat::mcset de "Bold" "Fett".. ::msgcat::mcset de "Bold Italic" "Fett kursiv".. ::msgcat::mcset de "&Blue" "&Blau".. ::msgcat::mcset de "Cancel" "Abbruch".. ::msgcat::mcset de "&Cancel" "&Abbruch".. ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.".. ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis".. ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen".. ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen".. ::msgcat::mcset de "Color" "Farbe".. ::msgcat::mcset de "Console" "Konsole".. ::msgcat::mcset de "&Copy" "&Kopieren".. ::msgcat::mcset de "

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\el.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (355), with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8784
                                                                                                                                                                                                                                                Entropy (8bit):4.334043617395095
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:tVj/F+oxBHbkI8+xTqFt2zPJ0k63fRGIUvPXrfBNnzc+zIF7meUOT7GC8MO07S0g:fj9+AHlLoozHn7fBFrMVmehCAGb
                                                                                                                                                                                                                                                MD5:780F863903BBDAA6C371EC0D3C7E6D59
                                                                                                                                                                                                                                                SHA1:DF5D435E132BEE4C076A7FC577C8C275A8B68CD5
                                                                                                                                                                                                                                                SHA-256:3F6F155864FE59A341BFD869735E54DD21CEE21BBD038433D9B271AD77BA3F7E
                                                                                                                                                                                                                                                SHA-512:091965EE912513AE1943BE840A2E757188FBA6F760F7C47BE80D06313D59B051F183E3A29D4B1CEDE1F9E54CA3CA23D75FF2C3A3672A4E71FB56F0FA76F7FA0D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:## Messages for the Greek (Hellenic - "el") language...## Please report any changes/suggestions to:..## petasis@iit.demokritos.gr....namespace eval ::tk {.. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2".. ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...".. ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1".. ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2".. ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5".. ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7".. ::msgcat::mcset el \.."Cannot change to the directory \"%1\$s\".\nPermission denied." \.."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\en.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3377
                                                                                                                                                                                                                                                Entropy (8bit):4.279601088621442
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:sQ7dw5bO0V3gqmCNyoKJ6iwp/uvENv4SKEcET2hsHFjr:n7dwNOc3RmOKJQcvEl4SK1ET2hYFjr
                                                                                                                                                                                                                                                MD5:D48CFC9EC779085E8F6AAA7B1C40C89A
                                                                                                                                                                                                                                                SHA1:0CF6253BFF39F40CA0991F9B06D3394BFEA21ED2
                                                                                                                                                                                                                                                SHA-256:4A33B44B2E220E28EAAE7FAC407CAFE43D97C270DA58FA5F3B699A1760BFB2A4
                                                                                                                                                                                                                                                SHA-512:C00EC0CFB48ABE621EF625C51952BCF177CE3BC7F0DEC5276EF84C9A97C7E014806B106EA8DEE202C43F8DD54ED7261A8D899E3EE12E3F37A90C387D864463AE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset en "&Abort".. ::msgcat::mcset en "&About...".. ::msgcat::mcset en "All Files".. ::msgcat::mcset en "Application Error".. ::msgcat::mcset en "&Apply".. ::msgcat::mcset en "Bold".. ::msgcat::mcset en "Bold Italic".. ::msgcat::mcset en "&Blue".. ::msgcat::mcset en "Cancel".. ::msgcat::mcset en "&Cancel".. ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.".. ::msgcat::mcset en "Choose Directory".. ::msgcat::mcset en "Cl&ear".. ::msgcat::mcset en "&Clear Console".. ::msgcat::mcset en "Color".. ::msgcat::mcset en "Console".. ::msgcat::mcset en "&Copy".. ::msgcat::mcset en "Cu&t".. ::msgcat::mcset en "&Delete".. ::msgcat::mcset en "Details >>".. ::msgcat::mcset en "Directory \"%1\$s\" does not exist.".. ::msgcat::mcset en "&Directory:".. ::msgcat::mcset en "&Edit".. ::msgcat::mcset en "Effects".. ::msgcat::mcset en "Error: %1\$s".. ::msgcat::mcs

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\en_gb.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):66
                                                                                                                                                                                                                                                Entropy (8bit):4.262228832346611
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:fEGp6fRyv//mGoW8vMKEQXyVn:sooyv//xoQOOn
                                                                                                                                                                                                                                                MD5:3D41FC47CD9936F817EF9645D73A77ED
                                                                                                                                                                                                                                                SHA1:E62BBE094B71CAF4A389DE3ECD84D2EEFBA33827
                                                                                                                                                                                                                                                SHA-256:01238293356E82F1D298896491F8B299BB7DC9C34F299C9E756254C736DA612B
                                                                                                                                                                                                                                                SHA-512:B92582C32C4D7CD9DE6571CBB6B93DD693A8B5A80645468E2D02B80C339BE2B95D5B4878A0DA9AFFE9E2F98A6C38AAE9CC1FF2440146D0ED128FE8C9A92EECDB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset en_gb Color Colour..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\eo.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4035
                                                                                                                                                                                                                                                Entropy (8bit):4.614759526381991
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:n6oXunu4/LQmI+nl0WemQ+uISIKk/2nibN5My/uXcFSZHBohy:n6oXuu4jJtlPemVuISIKkuniJS1Gy
                                                                                                                                                                                                                                                MD5:3704A08985B0AA3C521FDF9C2DA59D97
                                                                                                                                                                                                                                                SHA1:3F1E42C5697504B4DEE1EE314CD361B4203BF686
                                                                                                                                                                                                                                                SHA-256:84B117857674A2426290946053A61316C5C8C6808F2C6EDF0ECC5C4A9C5C72AC
                                                                                                                                                                                                                                                SHA-512:99FE97B10B1CA59DDA0385161E7C05F7D22424B6B1FB844138921EF94B2E9809D73EBC0062897D0DDE040CF92C96A6E4916CC9F3F02442AE2C4162858434B6BA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset eo "&Abort" "&\u0108esigu".. ::msgcat::mcset eo "&About..." "Pri...".. ::msgcat::mcset eo "All Files" "\u0108iuj dosieroj".. ::msgcat::mcset eo "Application Error" "Aplikoeraro".. ::msgcat::mcset eo "&Blue" "&Blua".. ::msgcat::mcset eo "Cancel" "Rezignu".. ::msgcat::mcset eo "&Cancel" "&Rezignu".. ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u015dan\u011di al dosierujo \"%1\$s\".\nVi ne rajtas tion.".. ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujon".. ::msgcat::mcset eo "Cl&ear" "&Vakigu".. ::msgcat::mcset eo "&Clear Console" "&Vakigu konzolon".. ::msgcat::mcset eo "Color" "Koloro".. ::msgcat::mcset eo "Console" "Konzolo".. ::msgcat::mcset eo "&Copy" "&Kopiu".. ::msgcat::mcset eo "Cu&t" "&Eltondu".. ::msgcat::mcset eo "&Delete" "&Forigu".. ::msgcat::mcset eo "Details >>" "Detaloj >>".. ::msgcat::mcset eo "Directory \"%1\$s\" does not exi

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\es.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4024
                                                                                                                                                                                                                                                Entropy (8bit):4.536517819515934
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nN0T1Lt8ZYSih/aiik148aFscyTzoixccUTqjcg60Dx/H5:nN0BLSQUXy/o8re055
                                                                                                                                                                                                                                                MD5:4765F3C055742530E4644771EBC6C69F
                                                                                                                                                                                                                                                SHA1:8BEA722AC00522DEAA5B380AEEF4CA57D7A271BD
                                                                                                                                                                                                                                                SHA-256:D2842B80F1B521EFF2D2656A69274B5F2A8F4F5831AF2E8EE73E3C37389F981F
                                                                                                                                                                                                                                                SHA-512:9CA247F22797A1A1FCA42B5CDABF58262ED95EECDDD321CEB1440A60A4375923E0F511238F360D159EB5EED6F82CBBE0B8907A07CC77DB831BF97082932CD0FD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset es "&Abort" "&Abortar".. ::msgcat::mcset es "&About..." "&Acerca de ...".. ::msgcat::mcset es "All Files" "Todos los archivos".. ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n".. ::msgcat::mcset es "&Blue" "&Azul".. ::msgcat::mcset es "Cancel" "Cancelar".. ::msgcat::mcset es "&Cancel" "&Cancelar".. ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.".. ::msgcat::mcset es "Choose Directory" "Elegir directorio".. ::msgcat::mcset es "Cl&ear" "&Borrar".. ::msgcat::mcset es "&Clear Console" "&Borrar consola".. ::msgcat::mcset es "Color".. ::msgcat::mcset es "Console" "Consola".. ::msgcat::mcset es "&Copy" "&Copiar".. ::msgcat::mcset es "Cu&t" "Cor&tar".. ::msgcat::mcset es "&Delete" "&Borrar".. ::msgcat::mcset es "Details >>" "Detalles >>".. ::msgcat::mcset es "Directory \"%1\$s\"

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\fi.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4693
                                                                                                                                                                                                                                                Entropy (8bit):4.640083757706223
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:najdLGoC0TXwqTwPRNQXfdHzAIX169ZZv6CpvgIPJupuupw6kWVVxn6/9Yv:nWdLGo2WiMn4t5pvbxuPtx6F6
                                                                                                                                                                                                                                                MD5:BD795A1D95446BEE7AEB16FB6E346271
                                                                                                                                                                                                                                                SHA1:38469DBD386C35B90EBE0A0FE2CE9F1AB5A5444A
                                                                                                                                                                                                                                                SHA-256:893BEDCDAED4602898D988E6248B8BB0857DD66C06194B45F31340CA03D82369
                                                                                                                                                                                                                                                SHA-512:B9BDDECB1DE2025C6C4027BF6228A14D5F573F5859ED3444298809266F06E6203F72004D589314C6529A2E198039355B4FD6160F87DA8F97B55E9F841B6C3F5A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset fi "&Abort" "&Keskeyt\u00e4".. ::msgcat::mcset fi "&About..." "&Tietoja...".. ::msgcat::mcset fi "All Files" "Kaikki tiedostot".. ::msgcat::mcset fi "Application Error" "Ohjelmavirhe".. ::msgcat::mcset fi "&Apply" "K\u00e4&yt\u00e4".. ::msgcat::mcset fi "Bold" "Lihavoitu".. ::msgcat::mcset fi "Bold Italic" "Lihavoitu, kursivoitu".. ::msgcat::mcset fi "&Blue" "&Sininen".. ::msgcat::mcset fi "Cancel" "Peruuta".. ::msgcat::mcset fi "&Cancel" "&Peruuta".. ::msgcat::mcset fi "Cannot change to the directory \"%1\$s\".\nPermission denied." "Ei voitu vaihtaa hakemistoon \"%1\$s\".\nLupa ev\u00e4tty.".. ::msgcat::mcset fi "Choose Directory" "Valitse hakemisto".. ::msgcat::mcset fi "Cl&ear" "&Tyhjenn\u00e4".. ::msgcat::mcset fi "&Clear Console" "&Tyhjenn\u00e4 konsoli".. ::msgcat::mcset fi "Color" "V\u00e4ri".. ::msgcat::mcset fi "Console" "Konsoli".. ::msgcat::mcset fi "&Copy" "K&opioi".. ::msgcat::mcs

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\fr.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3877
                                                                                                                                                                                                                                                Entropy (8bit):4.630737553723335
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nByEWs/3lHFB9FamsIfSAzZ2eaISAxh0BRc3jC:nByEWaRNzsSSWonMAv
                                                                                                                                                                                                                                                MD5:E279E5FFF03E1B8E9063ABC8A499A6BD
                                                                                                                                                                                                                                                SHA1:80910911F6B4830BA4DCBA9A9EAD12C9F802DDC9
                                                                                                                                                                                                                                                SHA-256:3F2CEB4A33695AB6B56E27F61A4C60C029935BB026497D99CB2C246BCB4A63C4
                                                                                                                                                                                                                                                SHA-512:8333388E421AC3F342317BEBE352809B0B190EF8B044A0BAE2FE4051974D86008BAFDCB7098E9DC39A8D9E1E08FB87F54B9D3388AF2D0185FF913DB6788C5AB5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset fr "&Abort" "&Annuler".. ::msgcat::mcset fr "About..." "\u00c0 propos...".. ::msgcat::mcset fr "All Files" "Tous les fichiers".. ::msgcat::mcset fr "Application Error" "Erreur d'application".. ::msgcat::mcset fr "&Blue" "&Bleu".. ::msgcat::mcset fr "Cancel" "Annuler".. ::msgcat::mcset fr "&Cancel" "&Annuler".. ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.".. ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire".. ::msgcat::mcset fr "Cl&ear" "Effacer".. ::msgcat::mcset fr "Color" "Couleur".. ::msgcat::mcset fr "Console".. ::msgcat::mcset fr "Copy" "Copier".. ::msgcat::mcset fr "Cu&t" "Couper".. ::msgcat::mcset fr "Delete" "Effacer".. ::msgcat::mcset fr "Details >>" "D\u00e9tails >>".. ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\"

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\hu.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4678
                                                                                                                                                                                                                                                Entropy (8bit):4.7955991577265245
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:nkCEz2TTrKmA17fzq/Hj+pUva+fQR/a5a/Thn5kU:kTqM17u/8NiMrhb
                                                                                                                                                                                                                                                MD5:4F1610E0C73DAE668E3F9D9235631152
                                                                                                                                                                                                                                                SHA1:63EE54A6C1A69B798C65C999D5F80A7AB252B6D8
                                                                                                                                                                                                                                                SHA-256:E063AD7CA93F37728A65E4CD7C0433950F22607D307949F6CB056446AFEAA4FE
                                                                                                                                                                                                                                                SHA-512:37F4B8A9CD020A77591C09AF40FBC2FA82107B2596D31B5F30CE6ECAA225417CF7A5C62FB7A93539B0D7E930D0A44F9BF2EE6BE113F831B0A72B229444672AFD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s".. ::msgcat::mcset hu "&About..." "N\u00e9vjegy...".. ::msgcat::mcset hu "All Files" "Minden f\u00e1jl".. ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba".. ::msgcat::mcset hu "&Blue" "&K\u00e9k".. ::msgcat::mcset hu "Cancel" "M\u00e9gsem".. ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem".. ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.".. ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa".. ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s".. ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol".. ::msgcat::mcset hu "Color" "Sz\u00edn".. ::msgcat::mcset hu "Console" "Konzol".. ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s".. ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s".. ::ms

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\it.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3765
                                                                                                                                                                                                                                                Entropy (8bit):4.49679862548805
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nmU4xnonTjwUE5Xs6ZrT8BpXAg+Wr+u92C8t7mU9nUSs:nZ4FonFE58HBpXjr+fBJs
                                                                                                                                                                                                                                                MD5:B74C54666A5A431A782DB691B4CA3315
                                                                                                                                                                                                                                                SHA1:2BC63982C14BBA8A4C451CE31540181F40CE2216
                                                                                                                                                                                                                                                SHA-256:806930F283FD097195C7850E3486B3815D1564529B4F8E5FA6D26F3175183BC1
                                                                                                                                                                                                                                                SHA-512:8120E2FFD14E0A992E254796ADDC0DC995C921BE31688C0995D7A36FE82609D78791FEF73EAF5B14E2F0D40AD256AB8DAAA07C18E6950362B28E40B71E47C0B6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset it "&Abort" "&Interrompi".. ::msgcat::mcset it "&About..." "Informazioni...".. ::msgcat::mcset it "All Files" "Tutti i file".. ::msgcat::mcset it "Application Error" "Errore dell' applicazione".. ::msgcat::mcset it "&Blue" "&Blu".. ::msgcat::mcset it "Cancel" "Annulla".. ::msgcat::mcset it "&Cancel" "&Annulla".. ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.".. ::msgcat::mcset it "Choose Directory" "Scegli una directory".. ::msgcat::mcset it "Cl&ear" "Azzera".. ::msgcat::mcset it "&Clear Console" "Azzera Console".. ::msgcat::mcset it "Color" "Colore".. ::msgcat::mcset it "Console".. ::msgcat::mcset it "&Copy" "Copia".. ::msgcat::mcset it "Cu&t" "Taglia".. ::msgcat::mcset it "Delete" "Cancella".. ::msgcat::mcset it "Details >>" "Dettagli >>".. ::msgcat::mcset it "Directory \"%1\$s\" does not ex

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\nl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4557
                                                                                                                                                                                                                                                Entropy (8bit):4.524344068436489
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nucQswBju0x0M4U2z9KSSOzZL5KhWTqGGIrlxXvhYbL/ZO5NT+T4kiLzzdDf1SDM:nLGa0x0Mp2KSHKSv2bL/ZO5u6nRfAXU9
                                                                                                                                                                                                                                                MD5:E56229BAC5A8ABB90C4DD8EE3F9FF9F8
                                                                                                                                                                                                                                                SHA1:7527D6C3C6C84BFF0E683FFA86A21C58458EB55D
                                                                                                                                                                                                                                                SHA-256:0914FBA42361227D14FA281E8A9CBF57C16200B4DA1E61CC3402EF0113A512C7
                                                                                                                                                                                                                                                SHA-512:13649DDB06DB4BA9E39BEAF828211086A519444DA9AB5CBDD1B88B29208388189A5141F75AD94B56A348EDDE534FFADE8B19B557CB988EA4ECC9A84B135D36C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset nl "&Abort" "&Afbreken".. ::msgcat::mcset nl "&About..." "Over...".. ::msgcat::mcset nl "All Files" "Alle Bestanden".. ::msgcat::mcset nl "Application Error" "Toepassingsfout".. ::msgcat::mcset nl "&Apply" "Toepassen".. ::msgcat::mcset nl "Bold" "Vet".. ::msgcat::mcset nl "Bold Italic" "Vet Cursief".. ::msgcat::mcset nl "&Blue" "&Blauw".. ::msgcat::mcset nl "Cancel" "Annuleren".. ::msgcat::mcset nl "&Cancel" "&Annuleren".. ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.".. ::msgcat::mcset nl "Choose Directory" "Kies map".. ::msgcat::mcset nl "Cl&ear" "Wissen".. ::msgcat::mcset nl "&Clear Console" "&Wis Console".. ::msgcat::mcset nl "Color" "Kleur".. ::msgcat::mcset nl "Console".. ::msgcat::mcset nl "&Copy" "Kopi\u00ebren".. ::msgcat::mcset nl "Cu&t" "Knippen".. ::msgcat::mcset nl "&Dele

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\pl.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4932
                                                                                                                                                                                                                                                Entropy (8bit):4.799369674927008
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nXra9E310fwNCeVsvSmy6MZv8lWBTDGdZ3tojTyrEQmAUCIx4wBxZ:n7a9Q0fyw5MQWgP3uoZChB3
                                                                                                                                                                                                                                                MD5:8CFA2E38822303FDCB55AE3277F0B81B
                                                                                                                                                                                                                                                SHA1:447F28A5064FCEA019C60B3F9B6D50CD43C2D0E3
                                                                                                                                                                                                                                                SHA-256:EACEB1F08DE0863CCF726881E07FE5B135EA09646C5253E0CBF7DDB987EB0D92
                                                                                                                                                                                                                                                SHA-512:E38BA9059AFF55C2B22A4AE24D6A76149C76DBA8BF8646AE81D6E07D7ED490D0605034B29D9AC848E6685C8EC26A3DBE5B2EAF462B14D96376E80076FBE7082A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset pl "&Abort" "&Przerwij".. ::msgcat::mcset pl "&About..." "O programie...".. ::msgcat::mcset pl "All Files" "Wszystkie pliki".. ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie".. ::msgcat::mcset pl "&Apply" "Zastosuj".. ::msgcat::mcset pl "Bold" "Pogrubienie".. ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa".. ::msgcat::mcset pl "&Blue" "&Niebieski".. ::msgcat::mcset pl "Cancel" "Anuluj".. ::msgcat::mcset pl "&Cancel" "&Anuluj".. ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.".. ::msgcat::mcset pl "Choose Directory" "Wybierz katalog".. ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107".. ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119".. ::msgcat::mcset pl "Color" "Kolor".. ::msgcat::mcset pl "Console" "Konsola".. ::msgcat::mcset pl "&Copy" "&Kopiu

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\pt.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3987
                                                                                                                                                                                                                                                Entropy (8bit):4.63232183429232
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nHOT1mM5qHHxiBHb3joTjtcp2UqMxweo6VvilCMKKXx9vjM:nHOT1mMQnwB/otcUUpGX6VPVoLjM
                                                                                                                                                                                                                                                MD5:4018686F2A8E299D86BDB1478BC97896
                                                                                                                                                                                                                                                SHA1:0EECE3D57F2EA5EECE8157B06F3AFB97E1F2551A
                                                                                                                                                                                                                                                SHA-256:D687F71F0432BB0D02EFDF576E526D2C19D4136F76C41A3224A2F034168F3F34
                                                                                                                                                                                                                                                SHA-512:4D730068B2A21E1D6004205B10A9D0D5EE9683FEB03B6FB673E8B9B94ED6BE468086A52DFE97C4DBF35A07CBB2C5E276DF0952A06C78E029D53D796CB6FCC8DF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset pt "&Abort" "&Abortar".. ::msgcat::mcset pt "About..." "Sobre ...".. ::msgcat::mcset pt "All Files" "Todos os arquivos".. ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o".. ::msgcat::mcset pt "&Blue" "&Azul".. ::msgcat::mcset pt "Cancel" "Cancelar".. ::msgcat::mcset pt "&Cancel" "&Cancelar".. ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.".. ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio".. ::msgcat::mcset pt "Cl&ear" "Apagar".. ::msgcat::mcset pt "&Clear Console" "Apagar Console".. ::msgcat::mcset pt "Color" "Cor".. ::msgcat::mcset pt "Console".. ::msgcat::mcset pt "&Copy" "Copiar".. ::msgcat::mcset pt "Cu&t" "Recortar".. ::msgcat::mcset pt "&Delete" "Excluir".. ::msgcat::mcset pt "Details >>" "Detalhes >>".. ::msgcat::mcset pt "D

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\ru.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8620
                                                                                                                                                                                                                                                Entropy (8bit):4.477728981060218
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:n9MEBGkFKT4YHCDhxqEMk0yOC2xXLtSRoxwKl9zFAWx2yuV9cDcwRjnWNQuNFNfO:T0rm8IONoRkN1w+jRQ/FoxrRHRJP
                                                                                                                                                                                                                                                MD5:C69A904A57FDC95520086E9DDFED362C
                                                                                                                                                                                                                                                SHA1:F0220602ABE91FE563E5AA6A4EA4AB43818C0CFC
                                                                                                                                                                                                                                                SHA-256:F0D310A2EE9C0AF928D822CBB39BCBE54FB2C1C95EE8167DFFD55EDC1B2FE040
                                                                                                                                                                                                                                                SHA-512:808B82F29B7BA06AF5AE44C6C23EC8DD743E93B391F060C7586D6D3FF26C97294BD11AD215848EBA422491BD50C4509330DD24C83134C7A384E81304133CAADB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...".. ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b".. ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435".. ::msgcat::mcset ru "&Apply" "&\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "Bold" "Bold".. ::msgcat::mcset ru "Bold Italic" "Bold Italic".. ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439".. ::msgcat::mcset ru "Cancel" "\u041e\u0442\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \....."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u043

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\sv.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3908
                                                                                                                                                                                                                                                Entropy (8bit):4.658068191079967
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nT8A5cbwKmtI1sE9xt6BDyepTr2iiK/yGqXZlBp9:nD5cb2extDepTCnVpJ9
                                                                                                                                                                                                                                                MD5:1D085A672A6FCDECEF5D7D876E4C74A3
                                                                                                                                                                                                                                                SHA1:1A40C03F15A6926359CA3E5C0A809485CAD28AEE
                                                                                                                                                                                                                                                SHA-256:A6821A13D34FB31F1827294B82C4BF9586BB255CA14F78C3ACE11181F42EF211
                                                                                                                                                                                                                                                SHA-512:981EDEEF5E4C915BB8F10044096B412D1855CAD08F98A448C6C0A49A54222945EBD102DDCB9525535E0FB19313C319155FA59384605B2C36CC8B4A58693D57E7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset sv "&Abort" "&Avsluta".. ::msgcat::mcset sv "&About..." "&Om...".. ::msgcat::mcset sv "All Files" "Samtliga filer".. ::msgcat::mcset sv "Application Error" "Programfel".. ::msgcat::mcset sv "&Blue" "&Bl\u00e5".. ::msgcat::mcset sv "Cancel" "Avbryt".. ::msgcat::mcset sv "&Cancel" "&Avbryt".. ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.".. ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp".. ::msgcat::mcset sv "Cl&ear" "&Radera".. ::msgcat::mcset sv "&Clear Console" "&Radera konsollen".. ::msgcat::mcset sv "Color" "F\u00e4rg".. ::msgcat::mcset sv "Console" "Konsoll".. ::msgcat::mcset sv "&Copy" "&Kopiera".. ::msgcat::mcset sv "Cu&t" "Klipp u&t".. ::msgcat::mcset sv "&Delete" "&Radera".. ::msgcat::mcset sv "Details >>" "Detaljer >>".. ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mapp

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\msgs\zh_cn.msg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4951
                                                                                                                                                                                                                                                Entropy (8bit):5.319678095131993
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:nnIoT3wHqLHQslojYhOvZSVGNUpi6Zz0qBAE9A+uiTrBsyqCgnPLz:nnIoT3wHU/osIAwNILt0HE2oV6CgPLz
                                                                                                                                                                                                                                                MD5:1435107EB17A09E4AD7277FFA1C76913
                                                                                                                                                                                                                                                SHA1:9990C26829275F16C6FC494D32C4298EC541E7D3
                                                                                                                                                                                                                                                SHA-256:B6802B7B080A2D8BC3D81614EC55A609CB5EF673C7A81E93E07925D6710F90DD
                                                                                                                                                                                                                                                SHA-512:4B2CAE4FA135411761D5B7CBFFABCE87D745A9B6496C7FD7C4AF10E76EE36E51CA62A1417CF6C27070EFF9539A305BE45C010AE4F8532C8C2D915FA101F5157E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:namespace eval ::tk {.. ::msgcat::mcset zh_cn "&Abort" "&..".. ::msgcat::mcset zh_cn "&About..." "&....".. ::msgcat::mcset zh_cn "All Files" "....".. ::msgcat::mcset zh_cn "Application Error" "......".. ::msgcat::mcset zh_cn "&Apply" "&..".. ::msgcat::mcset zh_cn "Bold" "..".. ::msgcat::mcset zh_cn "Bold Italic" "....".. ::msgcat::mcset zh_cn "&Blue" "&..".. ::msgcat::mcset zh_cn "Cancel" "..".. ::msgcat::mcset zh_cn "&Cancel" "&..".. ::msgcat::mcset zh_cn "Cannot change to the directory \"%1\$s\".\nPermission denied." "...... \"%1\$s\".\n......".. ::msgcat::mcset zh_cn "Choose Directory" ".....".. ::msgcat::mcset zh_cn "Cl&ear" ".&.".. ::msgcat::mcset zh_cn "&Clear Console" "&....".. ::msgcat::mcset zh_cn "Color" "..".. ::msgcat::mcset zh_cn "Console" "..".. ::msgcat::mcset zh_cn "&Copy" "&..".. ::msgcat::mcset zh

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\obsolete.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5772
                                                                                                                                                                                                                                                Entropy (8bit):5.038729016734604
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:onzxtm7EMgdMjwPqeuAmz9LD1kFIQETZqoIK/RLf7w:ozxtm7qUwi79l0sZqoBJLDw
                                                                                                                                                                                                                                                MD5:FC9E03823BEB08DAF7681C09D106DF7D
                                                                                                                                                                                                                                                SHA1:7D06FC8F98140E0FFAA2571BD522FC772E58DE54
                                                                                                                                                                                                                                                SHA-256:540EEECBA17207A56290BAFFDAE882BBD4F88364791204AD5D14C7BEDD022CCC
                                                                                                                                                                                                                                                SHA-512:2B5BAD311A703A0FE2ED67ACE311BAD4C767BCD23DFC3D9ABDF5C3604146A6A15D6BD13A14BDEFCDB2B602C708AACFAB404E96FCBA7C546AD0DAECD4BE2EB34A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# obsolete.tcl --..#..# This file contains obsolete procedures that people really shouldn't..# be using anymore, but which are kept around for backward compatibility...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# The procedures below are here strictly for backward compatibility with..# Tk version 3.6 and earlier. The procedures are no longer needed, so..# they are no-ops. You should not use these procedures anymore, since..# they may be removed in some future release.....proc tk_menuBar args {}..proc tk_bindForTraversal args {}....# ::tk::classic::restore --..#..# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic..# Tk widgets...#..# The value following an 'option add' call is the new 8.5 value...#..namespace eval ::tk::classic {.. # This may need t

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\optMenu.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1629
                                                                                                                                                                                                                                                Entropy (8bit):4.784780799273752
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:g2hBuOrlkBytcqYXRE5fvvXq1EhJPqOj6Wf0cVlN:gQ6q4E5HCqhBqOhcaD
                                                                                                                                                                                                                                                MD5:9B7A8FD2C6B538FF31BDC380452C6DE3
                                                                                                                                                                                                                                                SHA1:3F915BFE85CED9F6C7E9A352718770E9F14F098E
                                                                                                                                                                                                                                                SHA-256:40CA505C9784B0767D4854485C5C311829594A4FCBDFD7251E60E6BB7EA74FD1
                                                                                                                                                                                                                                                SHA-512:43937152B844BE1E597E99DA1270E54AB1D572AE89CB759E6D41C18C9C8044CCC15A6925F9C5AF617AE9EC1404E78C2733231F4D5C6CFE4D23C546387B1FC328
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# optMenu.tcl --..#..# This file defines the procedure tk_optionMenu, which creates..# an option button and its associated menu...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_optionMenu --..# This procedure creates an option button named $w and an associated..# menu. Together they provide the functionality of Motif option menus:..# they can be used to select one of many values, and the current value..# appears in the global variable varName, as well as in the text of..# the option menubutton. The name of the menu is returned as the..# procedure's result, so that the caller can use it to change configuration..# options on the menu or otherwise manipulate it...#..# Arguments:..# w -...The name to use for the menubutton...# varName -..Global variable to hold the currently

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\palette.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8418
                                                                                                                                                                                                                                                Entropy (8bit):4.964814946573677
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
                                                                                                                                                                                                                                                MD5:4CE08A10CD9AE941654B8C679DF669F3
                                                                                                                                                                                                                                                SHA1:F1288BABCA698FD18C3BD221E6AE6C02F2975AAE
                                                                                                                                                                                                                                                SHA-256:849B4C57E4644E51BEAEAEB3AE59B7FF067E582ECD10F1B2CAF6B6E72F11F506
                                                                                                                                                                                                                                                SHA-512:0F37539DA3540E9B1DA7B0377E3BBB359B71DB4271D63BC9501E95931B4E609E8CB91DC2F7B08A6452598D4A0D58C6A2034049A215000EEF0F93A9963D003632
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# palette.tcl --..#..# This file contains procedures that change the color palette used..# by Tk...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_setPalette --..# Changes the default color scheme for a Tk application by setting..# default colors in the option database and by modifying all of the..# color options for existing widgets that have the default value...#..# Arguments:..# The arguments consist of either a single color name, which..# will be used as the new background color (all other colors will..# be computed from this) or an even number of values consisting of..# option names and values. The name for an option is the one used..# for the option database, such as activeForeground, not -activeforeground.....proc ::tk_setPalette {args} {.. if {[winfo depth .] == 1} {...# Just return on monochrome displays, otherwise errors

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\panedwindow.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5370
                                                                                                                                                                                                                                                Entropy (8bit):4.979530133775421
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
                                                                                                                                                                                                                                                MD5:286C01A1B12261BC47F5659FD1627ABD
                                                                                                                                                                                                                                                SHA1:4CA36795CAB6DFE0BBBA30BB88A2AB71A0896642
                                                                                                                                                                                                                                                SHA-256:AA4F87E41AC8297F51150F2A9F787607690D01793456B93F0939C54D394731F9
                                                                                                                                                                                                                                                SHA-512:D54D5A89B7408A9724A1CA1387F6473BDAD33885194B2EC5A524C7853A297FD65CE2A57F571C51DB718F6A00DCE845DE8CF5F51698F926E54ED72CDC81BCFE54
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# panedwindow.tcl --..#..# This file defines the default bindings for Tk panedwindow widgets and..# provides procedures that help in implementing those bindings.....bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }..bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }....bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }..bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }....bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}..bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}....bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }....bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }....# Initialize namespace..namespace eval ::tk::panedwindow {}....# ::tk::panedwindow::MarkSash --..#..# Handle marking the correct sash for possible dragging..#..# Arguments:..# w..the widget..# x..widget local x coord..# y..widget local y coord..# proxy.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\pkgIndex.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):376
                                                                                                                                                                                                                                                Entropy (8bit):5.040809246948068
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6:CsUgabAOgjDnzJNBc6ynID/cL4RpncleXN17MQ9PCSIBIQ08hof7MQ9PCSIBIQei:lGbyntNO6LYZliCNBIUhkCNBIFi
                                                                                                                                                                                                                                                MD5:8A0517A7A4C70111080ED934329E2BC5
                                                                                                                                                                                                                                                SHA1:5B465E0D3500A8F04EE1C705662032F44E2ED0D2
                                                                                                                                                                                                                                                SHA-256:A5D208887A94832328C3A33928A80F3B46AA205C20DB4F050A47D940E94071B4
                                                                                                                                                                                                                                                SHA-512:D9F502A006A5E0514FD61426818AD1F4168E449588F9D383D6B0BF87A18BE82C420863A9A28E1BEB441284A0B1BC2A0B3D3276A0FE3196341AEC15A27920DE5D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:if {![package vsatisfies [package provide Tcl] 8.6.0]} return..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...|| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.6.13 [list load [file join $dir .. .. bin libtk8.6.dll]]..} else {.. package ifneeded Tk 8.6.13 [list load [file join $dir .. .. bin tk86t.dll]]..}..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\safetk.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7632
                                                                                                                                                                                                                                                Entropy (8bit):4.891666209090638
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
                                                                                                                                                                                                                                                MD5:21A3AC11146EC26784C0E729D8D644D0
                                                                                                                                                                                                                                                SHA1:C7E0918E8692C42C1D1DD1BBCBFFF22A85979B69
                                                                                                                                                                                                                                                SHA-256:579701605669AADFFBCDB7E3545C68442495428EE6E93C2D3A3133583BCD3D33
                                                                                                                                                                                                                                                SHA-512:724ED83B989AD9033BEC4211EE50E4C9E85B51054C518CDF7E02D0ED0416F636B9F38C0B0D29F8F4F7F465B77C7D2E01D0918D2C2C3FEC4C7739EA982302FA2E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# safetk.tcl --..#..# Support procs to use Tk in safe interpreters...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# see safetk.n for documentation....#..#..# Note: It is now ok to let untrusted code being executed..# between the creation of the interp and the actual loading..# of Tk in that interp because the C side Tk_Init will..# now look up the parent interp and ask its safe::TkInit..# for the actual parameters to use for it's initialization (if allowed),..# not relying on the child state...#....# We use opt (optional arguments parsing)..package require opt 0.4.1;....namespace eval ::safe {.... # counter for safe toplevels.. variable tkSafeId 0..}....#..# tkInterpInit : prepare the child interpreter for tk loading..# most of the real job is done by loadTk..# returns the child name (tkInterpInit

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\scale.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8693
                                                                                                                                                                                                                                                Entropy (8bit):4.968450834020619
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQGmLGKOC9dLrVx:KsbYQO48t+QYa+NkFjpagGmKKX9dLrVx
                                                                                                                                                                                                                                                MD5:D45202D3D2D052D4C6BFE8D1322AAB39
                                                                                                                                                                                                                                                SHA1:8CDF184AC2E9299B2B2A107A64E9D1803AA298DE
                                                                                                                                                                                                                                                SHA-256:0747A387FDD1B2C7135ECEAE7B392ED52E1D1EBF3FFA90FEBE886DBC0981EB74
                                                                                                                                                                                                                                                SHA-512:27B005F955BAE00D15C4492E7BD3EBDC5EE3BF9C164C418198B4BD185709C8810AA6CF76CBCC07EEB4C1D20F8C76EF8DF8B219563C18B88C94954C910BFF575D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# scale.tcl --..#..# This file defines the default bindings for Tk scale widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for entries...#-------------------------------------------------------------------------....# Standard Motif bindings:....bind Scale <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. tk::ScaleActivate %W %x %y..}..bind Scale <Motion> {.. tk::ScaleActivate %W %x %y..}..bind Scale <Leave> {.. if {$tk_strictMotif} {...%W configure -activebackground

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\scrlbar.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):13188
                                                                                                                                                                                                                                                Entropy (8bit):5.063842571848725
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
                                                                                                                                                                                                                                                MD5:5249CD1E97E48E3D6DEC15E70B9D7792
                                                                                                                                                                                                                                                SHA1:612E021BA25B5E512A0DFD48B6E77FC72894A6B9
                                                                                                                                                                                                                                                SHA-256:EEC90404F702D3CFBFAEC0F13BF5ED1EBEB736BEE12D7E69770181A25401C61F
                                                                                                                                                                                                                                                SHA-512:E4E0AB15EB9B3118C30CD2FF8E5AF87C549EAA9B640FFD809A928D96B4ADDEFB9D25EFDD1090FBD0019129CDF355BB2F277BC7194001BA1D2ED4A581110CEAFC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# scrlbar.tcl --..#..# This file defines the default bindings for Tk scrollbar widgets...# It also provides procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for scrollbars...#-------------------------------------------------------------------------....# Standard Motif bindings:..if {[tk windowingsystem] eq "x11" || [tk windowingsystem] eq "aqua"} {....bind Scrollbar <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. %W activate [%W identify %x %y]..}..bind Scrollbar <Motion> {.. %W activate [%

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\spinbox.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):16543
                                                                                                                                                                                                                                                Entropy (8bit):5.034958189335699
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:IMpfyeKu9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfyeKu9Tx8WODTp2zPP
                                                                                                                                                                                                                                                MD5:EAA36F0AA69AE19DDBDD0448FBAD9D4D
                                                                                                                                                                                                                                                SHA1:EB0ADB4F4D937BAC2F17480ADAF6F948262E754D
                                                                                                                                                                                                                                                SHA-256:747889C3086C917A34554A9DC495BC0C08A03FD3A5828353ED2A64B97F376835
                                                                                                                                                                                                                                                SHA-512:C8368F19EC6842ED67073B9FC9C9274107E643324CB23B28C54DF63FB720F63B043281B30DBEA053D08481B0442A87465F715A8AA0711B01CE83FF7B9F8A4F4C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# spinbox.tcl --..#..# This file defines the default bindings for Tk spinbox widgets and provides..# procedures that help in implementing those bindings. The spinbox builds..# off the entry widget, so it can reuse Entry bindings and procedures...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1999-2000 Jeffrey Hobbs..# Copyright (c) 2000 Ajuba Solutions..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\tclIndex

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):20523
                                                                                                                                                                                                                                                Entropy (8bit):4.786929402401609
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:eeVL0UI9Ms++J7VT/hc+ISyNsATbOan/uW/UFQ1gs1gxtKZufe2SvdJcmq/YbhEB:eeF0UI9Ms++J7VT/hc+ISyCATbOan2W+
                                                                                                                                                                                                                                                MD5:9378397DD3DCA9DFB181F6F512B15631
                                                                                                                                                                                                                                                SHA1:4F95DD6B658B6A912725DC7D6226F8414020D6C7
                                                                                                                                                                                                                                                SHA-256:B04B1A675572E6FCD12C5FE82C4FD0930395548436FF93D848BF340AE202E7E3
                                                                                                                                                                                                                                                SHA-512:D28CC3C8F3D0B1B2371CBD9EE29AC6881BABD8A07C762FF8F3284449998EE44FA44752CC8AB0DE47A3492776CE1D13BC8EA18CFDBDF710639D2D62D02CB917A9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# Tcl autoload index file, version 2.0..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]]..set auto_index(::tk::ButtonAutoInvoke) [list sou

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\tearoff.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5309
                                                                                                                                                                                                                                                Entropy (8bit):4.74935501162253
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:wfQXIqAv6iEwYtKVlPBnXWASbvMsDjXKpQQkK2tTsSZQ7Fowqm2K5r:wf+IqI6iU43PJYbvMsDjXKpsK2tISyZV
                                                                                                                                                                                                                                                MD5:5F042DE8AD8941C7B9EF6D7BE06C86E4
                                                                                                                                                                                                                                                SHA1:A4DFCEA2ACCAC2E85EAAA186DC765086D1E3AA3C
                                                                                                                                                                                                                                                SHA-256:A4A8568633F827B54326640E6D1C3FDE4978EDC9E9FA1FB1D7B58F189DF1B1DC
                                                                                                                                                                                                                                                SHA-512:E92A00028696A1557666CAB1C25AE6B63F25D75A9811BFAC56DFC069ECC769CC751B71CC81FA85C9CDE8F7FB6D7121EB64B58548CEE8AFE3F6C4A5C243507216
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# tearoff.tcl --..#..# This file contains procedures that implement tear-off menus...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk::TearoffMenu --..# Given the name of a menu, this procedure creates a torn-off menu..# that is identical to the given menu (including nested submenus)...# The new torn-off menu exists as a toplevel window managed by the..# window manager. The return value is the name of the new menu...# The window is created at the point specified by x and y..#..# Arguments:..# w -...The menu to be torn-off (duplicated)...# x -...x coordinate where window is created..# y -...y coordinate where window is created....proc ::tk::TearOffMenu {w {x 0} {y 0}} {.. # Find a unique name to use for the torn-off menu. Find the first.. # ancestor of w that is a

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\text.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):34969
                                                                                                                                                                                                                                                Entropy (8bit):4.95825801435303
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:Rp4LaQDlOrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:RYK8aymTGs1b0xncn6KR
                                                                                                                                                                                                                                                MD5:9CA5094ED6FE46620ABF090BF8E2AE63
                                                                                                                                                                                                                                                SHA1:60DC3C2E3F69CE5B6DB4F2B3A1F3C109D766BC63
                                                                                                                                                                                                                                                SHA-256:AB88556E349F03BACA2D8DC2121071A4F299DB86F484CAB2D9249FF4C7007564
                                                                                                                                                                                                                                                SHA-512:0B0C20A754BE744A7FA214BA06AB0744A9BC466D51F96310D97EA1E61119A8ACFEF24E6DC5C4EBDD2C126BF84ACE74FFE622E9641C87E5A240DD13D1F7B5E6AF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# text.tcl --..#..# This file defines the default bindings for Tk text widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of ::tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# char -..Character position on the line; kept in order..#...to allow moving up or down past short lines while..#...still remembering the desired position...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button we

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\tk.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):24102
                                                                                                                                                                                                                                                Entropy (8bit):5.137459715823081
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:NJyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59HmD:NJItNe9USZblXysm7GgteoFQRYMESL
                                                                                                                                                                                                                                                MD5:184D05201893B2042D3FA6140FCF277C
                                                                                                                                                                                                                                                SHA1:AAD67797864456749ADF0C4A1C0BE52F563C8FB8
                                                                                                                                                                                                                                                SHA-256:1D5E7518AFC1382E36BF13FC5196C8A7CD93A4E9D24ACF445522564245A489B0
                                                                                                                                                                                                                                                SHA-512:291BDF793CABC5EC27E8265A8A313FE0F4ACAB4DB6CE507A46488A83EEF72CD43CF5815762B22D1C8D64A9EEDEA927E109F937E6573058E5493B1354DD449CB3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# tk.tcl --..#..# Initialization script normally executed in the interpreter for each Tk-based..# application. Arranges class bindings for widgets...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....# Verify that we have Tk binary and script components from the same release..package require -exact Tk 8.6.13.....# Create a ::tk namespace..namespace eval ::tk {.. # Set up the msgcat commands.. namespace eval msgcat {...namespace export mc mcmax.. if {[interp issafe] || [catch {package require msgcat}]} {.. # The msgcat package is not available. Supply our own.. # minimal replacement... proc mc {src args} {.. return [format $src {*}$args].. }.. proc mc

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\tkfbox.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):39557
                                                                                                                                                                                                                                                Entropy (8bit):5.186073482848965
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:+oj+AqE9cn9tJNgDt0/vsKulXgo65Eh6pQb:+6+Zv/ggEdio65Ehdb
                                                                                                                                                                                                                                                MD5:670837EBC804E7B6E2F65F840BC508D6
                                                                                                                                                                                                                                                SHA1:2DD316487F87DDE5D05F65F564CAE4E1306CE662
                                                                                                                                                                                                                                                SHA-256:3AAA66AE8E74B94481C3F6642634E78BB5D7892771E7C27B54DFA56DED0B2F3C
                                                                                                                                                                                                                                                SHA-512:BB8350ADDF1A25C037DFD60A4AFCBF401CACAD2A370B60BD0BA0981D938C46394BD8D40D1E9A66F4E3C46FCC2A41CF688E78C4F1FE918B45E70D3E92D8B3D116
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# tkfbox.tcl --..#..#.Implements the "TK" standard file selection dialog box. This dialog..#.box is used on the Unix platforms whenever the tk_strictMotif flag is..#.not set...#..#.The "TK" standard file selection dialog box is similar to the file..#.selection dialog box on Win95(TM). The user can navigate the..#.directories by clicking on the folder icons or by selecting the..#."Directory" option menu. The user can select files by clicking on the..#.file icons or by entering a filename in the "Filename:" entry...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {.. namespace import -force ::tk::msgcat::*.. variable showHiddenBtn 0.. variable showHiddenVar 1.... # Create the images if they did not already exist... if {![info exists ::tk::Priv(updirImage)]} {...s

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\altTheme.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3713
                                                                                                                                                                                                                                                Entropy (8bit):4.915055696129498
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:InrWdo3L7Fe5qusQGdrMNnQbfIxEOxE0kFgG0FgGouox9FrGVuwg3kNcT+z5UlEr:UWdsOBn/1i+pqxwNjKs
                                                                                                                                                                                                                                                MD5:01F28512E10ACBDDF93AE2BB29E343BC
                                                                                                                                                                                                                                                SHA1:C9CF23D6315218B464061F011E4A9DC8516C8F1F
                                                                                                                                                                                                                                                SHA-256:AE0437FB4E0EBD31322E4EACA626C12ABDE602DA483BB39D0C5EE1BC00AB0AF4
                                                                                                                                                                                                                                                SHA-512:FE3BAE36DDB67F6D7A90B7A91B6EC1A009CF26C0167C46635E5A9CEAEC9083E59DDF74447BF6F60399657EE9604A2314B170F78A921CF948B2985DDF02A89DA6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Ttk widget set: Alternate theme..#....namespace eval ttk::theme::alt {.... variable colors.. array set colors {...-frame .."#d9d9d9"...-window.."#ffffff"...-darker ."#c3c3c3"...-border.."#414141"...-activebg ."#ececec"...-disabledfg."#a3a3a3"...-selectbg."#4a6984"...-selectfg."#ffffff"...-altindicator."#aaaaaa".. }.... ttk::style theme settings alt {.....ttk::style configure "." \... -background .$colors(-frame) \... -foreground .black \... -troughcolor.$colors(-darker) \... -bordercolor.$colors(-border) \... -selectbackground .$colors(-selectbg) \... -selectforeground .$colors(-selectfg) \... -font ..TkDefaultFont \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)] ;...ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -padding "1 1" \... -reli

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\aquaTheme.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3838
                                                                                                                                                                                                                                                Entropy (8bit):4.940737732832436
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:WdbclJFvlyLi+8OWXgQahpvAdNutdHrFBlCFBK2tdHkFBlhKgY1geAWUWeFVvtdp:C8EQPNeWgFeqdXj
                                                                                                                                                                                                                                                MD5:F07A3A86362E9E253BE91F59714FE134
                                                                                                                                                                                                                                                SHA1:84DE1AB2EAE62E4B114F0E613BD94955AFA9E6C7
                                                                                                                                                                                                                                                SHA-256:E199CC9C429B35A09721D0A22543C3729E2B8462E68DFA158C0CEC9C70A0D79D
                                                                                                                                                                                                                                                SHA-512:324EAF9F857076CA4FECB26D8DF76F8BB1D3F15EAE55D6B6C9689BF1682B306AC7A3592B6A518D23F9FE4DC21EFB6ACF1ECA948F889FA1ADFFA0E12C0BEAB57F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Aqua theme (OSX native look and feel)..#....namespace eval ttk::theme::aqua {.. ttk::style theme settings aqua {.....ttk::style configure . \... -font TkDefaultFont \... -background systemWindowBackgroundColor \... -foreground systemLabelColor \... -selectbackground systemSelectedTextBackgroundColor \... -selectforeground systemSelectedTextColor \... -selectborderwidth 0 \... -insertwidth 1.....ttk::style map . \... -foreground {....disabled systemDisabledControlTextColor....background systemLabelColor} \... -selectbackground {....background systemSelectedTextBackgroundColor....!focus systemSelectedTextBackgroundColor} \... -selectforeground {....background systemSelectedTextColor....!focus systemSelectedTextColor}.....# Button...ttk::style configure TButton -anchor center -width -6 \... -foreground systemControlTextColor...ttk::style map TButton \... -foreground {....pressed white... {alternate !pressed !background} white}...ttk::styl

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\button.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3014
                                                                                                                                                                                                                                                Entropy (8bit):4.917794267131833
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:A5N+EqJWR1eTC01cG61ELLgrDgk1JgQ6TQGvhV5giT6TUP+3JWMHTeJ:kN+RQfccG61ooDgQ6dNT6TUP+PHO
                                                                                                                                                                                                                                                MD5:D4BF1AF5DCDD85E3BD11DBF52EB2C146
                                                                                                                                                                                                                                                SHA1:B1691578041319E671D31473A1DD404855D2038B
                                                                                                                                                                                                                                                SHA-256:E38A9D1F437981AA6BF0BDD074D57B769A4140C0F7D9AFF51743FE4ECC6DFDDF
                                                                                                                                                                                                                                                SHA-512:25834B4B231F4FF1A88EEF67E1A102D1D0546EC3B0D46856258A6BE6BBC4B381389C28E2EB60A01FF895DF24D6450CD16CA449C71F82BA53BA438A4867A47DCD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Bindings for Buttons, Checkbuttons, and Radiobuttons...#..# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed"..# state; widgets remain "active" if the pointer is dragged out...# This doesn't seem to be conventional, but it's a nice way..# to provide extra feedback while the grab is active...# (If the button is released off the widget, the grab deactivates and..# we get a <Leave> event then, which turns off the "active" state)..#..# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are..# delivered to the widget which received the initial <Button>..# event. However, Tk [grab]s (#1223103) and menu interactions..# (#1222605) can interfere with this. To guard against spurious..# <Button1-Enter> events, the <Button1-Enter> binding only sets..# the pressed state if the button is currently active...#....namespace eval ttk::button {}....bind TButton <Enter> ..{ %W instate !disabled {%W state active} }..bind TButton <Leave>..{ %W state !active }..bind TButton <s

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\clamTheme.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4809
                                                                                                                                                                                                                                                Entropy (8bit):4.905115353394083
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:KrS4se/XhW03cC7TxPp/uo1ZUb0WZvSoetCgV+tMWG3xT3xgNB4x76FAuoxVYuIJ:oS4sSjWwFAGkhiP3xT3xL6B2bbe
                                                                                                                                                                                                                                                MD5:2B20E7B2E6BDDBEB14F5F63BF38DBF24
                                                                                                                                                                                                                                                SHA1:43DB48094C4BD7DE3B76AFBC051D887FEFE9887E
                                                                                                                                                                                                                                                SHA-256:CFFC59931FDD1683AD23895E92522CF49B099128753FCDFF34374024E42CF995
                                                                                                                                                                                                                                                SHA-512:1EB5EA78D26D18EAD6563AFBF1798F71723001DCC945E7DB3E4368564D0563029BE3565876AD8CB97331CFE34B2A0A313FA1BF252B87049160FE5DCD65434775
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# "Clam" theme...#..# Inspired by the XFCE family of Gnome themes...#....namespace eval ttk::theme::clam {.. variable colors.. array set colors {...-disabledfg.."#999999"...-frame .."#dcdad5"...-window .."#ffffff"...-dark..."#cfcdc8"...-darker .."#bab5ab"...-darkest.."#9e9a91"...-lighter.."#eeebe7"...-lightest .."#ffffff"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-altindicator.."#5895bc"...-disabledaltindicator."#a0a0a0".. }.... ttk::style theme settings clam {.....ttk::style configure "." \... -background $colors(-frame) \... -foreground black \... -bordercolor $colors(-darkest) \... -darkcolor $colors(-dark) \... -lightcolor $colors(-lighter) \... -troughcolor $colors(-darker) \... -selectbackground $colors(-selectbg) \... -selectforeground $colors(-selectfg) \... -selectborderwidth 0 \... -font TkDefaultFont \... ;.....ttk::style map "." \... -background [list disabled $colors(-frame) \..... active $colors(-lighter)] \..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\classicTheme.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3864
                                                                                                                                                                                                                                                Entropy (8bit):4.935603001745302
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:zcJZjdWs+WVB4ULsMF7tnvnuSuqo5DKxiFgG0FgGHx9FrGTtu/3Kt+iW2PbuAk38:zcJZEstB4UoituSm+VtYErY
                                                                                                                                                                                                                                                MD5:0205663142775F4EF2EB104661D30979
                                                                                                                                                                                                                                                SHA1:452A0D613288A1CC8A1181C3CC1167E02AA69A73
                                                                                                                                                                                                                                                SHA-256:424BBA4FB6836FEEBE34F6C176ED666DCE51D2FBA9A8D7AA756ABCBBAD3FC1E3
                                                                                                                                                                                                                                                SHA-512:FB4D212A73A6F5A8D2774F43D310328B029B52B35BEE133584D8326363B385AB7AA4AE25E98126324CC716962888321E0006E5F6EF8563919A1D719019B2D117
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# "classic" Tk theme...#..# Implements Tk's traditional Motif-like look and feel...#....namespace eval ttk::theme::classic {.... variable colors; array set colors {...-frame.."#d9d9d9"...-window.."#ffffff"...-activebg."#ececec"...-troughbg."#c3c3c3"...-selectbg."#c3c3c3"...-selectfg."#000000"...-disabledfg."#a3a3a3"...-indicator."#b03060"...-altindicator."#b05e5e".. }.... ttk::style theme settings classic {...ttk::style configure "." \... -font..TkDefaultFont \... -background..$colors(-frame) \... -foreground..black \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -troughcolor.$colors(-troughbg) \... -indicatorcolor.$colors(-frame) \... -highlightcolor.$colors(-frame) \... -highlightthickness.1 \... -selectborderwidth.1 \... -insertwidth.2 \... ;.....# To match pre-Xft X11 appearance, use:...#.ttk::style configure . -font {Helvetica 12 bold}.....ttk::style map "." -background \... [list disabled

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\combobox.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12718
                                                                                                                                                                                                                                                Entropy (8bit):5.063548300335668
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
                                                                                                                                                                                                                                                MD5:F7065D345A4BFB3127C3689BF1947C30
                                                                                                                                                                                                                                                SHA1:9631C05365B0F5A36E4CA5CBA83628CCD7FCBDE1
                                                                                                                                                                                                                                                SHA-256:68EED4AF6D2EC5B3EA24B1122A704B040366CBE2F458103137479352FFA1475A
                                                                                                                                                                                                                                                SHA-512:74B99B9E326680150DD5EC7263192691BCD8A71B2A4EE7F3177DEDDD43E924A7925085C6D372731A70570F96B3924450255B2F54CA3B9C44D1160CA37E715B00
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Combobox bindings...#..# <<NOTE-WM-TRANSIENT>>:..#..#.Need to set [wm transient] just before mapping the popdown..#.instead of when it's created, in case a containing frame..#.has been reparented [#1818441]...#..#.On Windows: setting [wm transient] prevents the parent..#.toplevel from becoming inactive when the popdown is posted..#.(Tk 8.4.8+)..#..#.On X11: WM_TRANSIENT_FOR on override-redirect windows..#.may be used by compositing managers and by EWMH-aware..#.window managers (even though the older ICCCM spec says..#.it's meaningless)...#..#.On OSX: [wm transient] does utterly the wrong thing...#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]...#.The "noActivates" attribute prevents the parent toplevel..#.from deactivating when the popdown is posted, and is also..#.necessary for "help" windows to receive mouse events...#."hideOnSuspend" makes the popdown disappear (resp. reappear)..#.when the parent toplevel is deactivated (resp. reactivated)...#.(see [#18147

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\cursors.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4674
                                                                                                                                                                                                                                                Entropy (8bit):4.836935825704301
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:DRYEqfLDxGmxGUetobPT6t6brv0q3O4Uxz0:DWEqTDbxdKobPqe5PUxw
                                                                                                                                                                                                                                                MD5:1A799FE3754307A5AADE98C367E2F5D7
                                                                                                                                                                                                                                                SHA1:C64BE4B77F0D298610F4EE20FCEBBAEE3C8B5F22
                                                                                                                                                                                                                                                SHA-256:5B33F32B0139663347D6CF70A5A838F8E4554E0E881E97C8478B77733162EA73
                                                                                                                                                                                                                                                SHA-512:89F367F9A59730BCDFC5ABDE0E35A10B72A1F19C68A768BA4524C938EF5C5CAF094C1BFA8FC74173F65201F6617544223C2143252A9F691EE9AAA7543315179F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Map symbolic cursor names to platform-appropriate cursors...#..# The following cursors are defined:..#..#.standard.-- default cursor for most controls..#.""..-- inherit cursor from parent window..#.none..-- no cursor..#..#.text..-- editable widgets (entry, text)..#.link..-- hyperlinks within text..#.crosshair.-- graphic selection, fine control..#.busy..-- operation in progress..#.forbidden.-- action not allowed..#..#.hresize..-- horizontal resizing..#.vresize..-- vertical resizing..#..# Also resize cursors for each of the compass points,..# {nw,n,ne,w,e,sw,s,se}resize...#..# Platform notes:..#..# Windows doesn't distinguish resizing at the 8 compass points,..# only horizontal, vertical, and the two diagonals...#..# OSX doesn't have resize cursors for nw, ne, sw, or se corners...# We use the Tk-defined X11 fallbacks for these...#..# X11 doesn't have a "forbidden" cursor (usually a slashed circle);..# "pirate" seems to be the conventional cursor for this purpose...#..# Windows has a

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\defaults.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4553
                                                                                                                                                                                                                                                Entropy (8bit):4.933885986949396
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
                                                                                                                                                                                                                                                MD5:FC79F42761D63172163C08F0F5C94436
                                                                                                                                                                                                                                                SHA1:AABAB4061597D0D6DC371F46D14AAA1A859096DF
                                                                                                                                                                                                                                                SHA-256:49AE8FAF169165BDDAF01D50B52943EBAB3656E9468292B7890BE143D0FCBC91
                                                                                                                                                                                                                                                SHA-512:F619834A95C9DEB93F8184BCC437D701A961C77E24A831ADBD5C145556D26986BFDA2A6ACB9E8784F8B2380E122D12AC893EB1B6ACF03098922889497E1FF9EA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Settings for default theme...#....namespace eval ttk::theme::default {.. variable colors.. array set colors {...-frame..."#d9d9d9"...-foreground.."#000000"...-window..."#ffffff"...-text .."#000000"...-activebg.."#ececec"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-darker .."#c3c3c3"...-disabledfg.."#a3a3a3"...-indicator.."#4a6984"...-disabledindicator."#a3a3a3"...-altindicator.."#9fbdd8"...-disabledaltindicator."#c0c0c0".. }.... ttk::style theme settings default {.....ttk::style configure "." \... -borderwidth .1 \... -background .$colors(-frame) \... -foreground .$colors(-foreground) \... -troughcolor .$colors(-darker) \... -font ..TkDefaultFont \... -selectborderwidth.1 \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -insertwidth .1 \... -indicatordiameter.10 \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)]...ttk::style map "."

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\entry.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):17658
                                                                                                                                                                                                                                                Entropy (8bit):5.026830367336785
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:sca9Jzcyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9Jzcy76wiV3YNa
                                                                                                                                                                                                                                                MD5:7FFD7A32C7F8E234763E99E3357DB624
                                                                                                                                                                                                                                                SHA1:67C67557F3A6DC8B240E85D46F6B733FEE45A013
                                                                                                                                                                                                                                                SHA-256:266553EB9EED333DD836BA96204AE008F10686F4F12C404187F1E01CAB65D246
                                                                                                                                                                                                                                                SHA-512:D18B73E44F37ED92B9FD7C1F6510285D1280EB5BC665B46996E538924E9D1CAD63337279BF92587132C3AEA497325A17CCE671EA59537B350F6D921C25346F39
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# DERIVED FROM: tk/library/entry.tcl r1.22..#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 2004, Joe English..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ttk {.. namespace eval entry {...variable State.....set State(x) 0...set State(selectMode) none...set State(anchor) 0...set State(scanX) 0...set State(scanIndex) 0...set State(scanMoved) 0.....# Button-2 scan speed is (scanNum/scanDen) characters...# per pixel of mouse movement....# The standard Tk entry widget uses the equivalent of...# scanNum = 10, scanDen = average character width....# I don't know why that was chosen....#...set State(scanNum) 1...set State(scanDen) 1...set State(deadband) 3.;# #pixels for mouse-moved deadband... }..}....### Option database settings...#..option add *TEntry.cursor [ttk::cursor text] widg

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\fonts.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5732
                                                                                                                                                                                                                                                Entropy (8bit):5.001928619185109
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
                                                                                                                                                                                                                                                MD5:80331FCBE4C049FF1A0D0B879CB208DE
                                                                                                                                                                                                                                                SHA1:4EB3EFDFE3731BD1AE9FD52CE32B1359241F13CF
                                                                                                                                                                                                                                                SHA-256:B94C319E5A557A5665B1676D602B6495C0887C5BACF7FA5B776200112978BB7B
                                                                                                                                                                                                                                                SHA-512:A4BD2D91801C121A880225F1F3D0C4E30BF127190CF375F6F7A49EB4239A35C49C44F453D6D3610DF0D6A7B3CB15F4E79BD9C129025CC496CEB856FCC4B6DE87
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Font specifications...#..# This file, [source]d at initialization time, sets up the following..# symbolic fonts based on the current platform:..#..# TkDefaultFont.-- default for GUI items not otherwise specified..# TkTextFont.-- font for user text (entry, listbox, others)..# TkFixedFont.-- standard fixed width font..# TkHeadingFont.-- headings (column headings, etc)..# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.)..# TkTooltipFont.-- font to use for tooltip windows..# TkIconFont.-- font to use for icon captions..# TkMenuFont.-- used to use for menu items..#..# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation..# (On Windows and Mac OS X as of Oct 2007)...#..# +++ Platform notes:..#..# Windows:..#.The default system font changed from "MS Sans Serif" to "Tahoma"..# .in Windows XP/Windows 2000...#..#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,..#.although many MS programs still use "MS Sans Serif 8"..#..#.Should use

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\menubutton.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6443
                                                                                                                                                                                                                                                Entropy (8bit):4.9213750923402735
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:toMcJQkmcE6fNuLyiCzSLSRwgppdT3kXdpK3dpKkSH2tOTjvAG:tRc6kFbcH2pyXz+zO2y
                                                                                                                                                                                                                                                MD5:F11A76FBABF35E446A1200A5A7A6730A
                                                                                                                                                                                                                                                SHA1:4CBAB3507C1EF275691C98620D2B5CEEB9043B3E
                                                                                                                                                                                                                                                SHA-256:54663FBF524CAD9D74AB1EC44B7FDDE0B87F06E5347191962C97F51F714E29BB
                                                                                                                                                                                                                                                SHA-512:95471D1519AE663EC7EB4639D847019E0C9F70DEA2B0680D81FB8BBE7CD1FF643A3DF5E06CA2CC54385BE094BDCC64AB0F1AA1652F91D16C4EF7B68CB670371E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Bindings for Menubuttons...#..# Menubuttons have three interaction modes:..#..# Pulldown: Press menubutton, drag over menu, release to activate menu entry..# Popdown: Click menubutton to post menu..# Keyboard: <space> or accelerator key to post menu..#..# (In addition, when menu system is active, "dropdown" -- menu posts..# on mouse-over. Ttk menubuttons don't implement this)...#..# For keyboard and popdown mode, we hand off to tk_popup and let..# the built-in Tk bindings handle the rest of the interaction...#..# ON X11:..#..# Standard Tk menubuttons use a global grab on the menubutton...# This won't work for Ttk menubuttons in pulldown mode,..# since we need to process the final <ButtonRelease> event,..# and this might be delivered to the menu. So instead we..# rely on the passive grab that occurs on <Button> events,..# and transition to popdown mode when the mouse is released..# or dragged outside the menubutton...#..# ON WINDOWS:..#..# I'm not sure what the hell is going on h

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\notebook.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5825
                                                                                                                                                                                                                                                Entropy (8bit):4.96378772387536
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
                                                                                                                                                                                                                                                MD5:F811F3E46A4EFA73292F40D1CDDD265D
                                                                                                                                                                                                                                                SHA1:7FC70A1984555672653A0840499954B854F27920
                                                                                                                                                                                                                                                SHA-256:22264D8D138E2C0E9A950305B4F08557C5A73F054F8215C0D8CE03854042BE76
                                                                                                                                                                                                                                                SHA-512:4424B7C687EB9B1804ED3B1C685F19D4D349753B374D9046240F937785C9713E8A760ADA46CB628C15F9C7983CE4A7987691C968330478C9C1A9B74E953E40AC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Bindings for TNotebook widget..#....namespace eval ttk::notebook {.. variable TLNotebooks ;# See enableTraversal..}....bind TNotebook <Button-1>..{ ttk::notebook::Press %W %x %y }..bind TNotebook <Right>...{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Left>...{ ttk::notebook::CycleTab %W -1; break }..bind TNotebook <Control-Tab>..{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Control-Shift-Tab>.{ ttk::notebook::CycleTab %W -1; break }..catch {..bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }..}..bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }....# ActivateTab $nb $tab --..#.Select the specified tab and set focus...#..# Desired behavior:..#.+ take focus when reselecting the currently-selected tab;..#.+ keep focus if the notebook already has it;..#.+ otherwise set focus to the first traversable widget..#. in the newly-selected tab;..#.+ do not leave the focus in a deselected tab...#..proc ttk::notebook::ActivateTab {

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\panedwindow.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2274
                                                                                                                                                                                                                                                Entropy (8bit):4.951790637542993
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:zVAqE3ZF8b4rXzsqAOAXsmCLFeNqkFeNXez:zLeU4bzSs1M
                                                                                                                                                                                                                                                MD5:848A62BCF6ED3C16A8CFD26C43E1BC4E
                                                                                                                                                                                                                                                SHA1:6F5E3EDF62716B511CF575BE2C6C997AFA2FA1E7
                                                                                                                                                                                                                                                SHA-256:20EE6AD9D701709724292A926AF93C93784B254B48A656ECC140EF3A0FE10A11
                                                                                                                                                                                                                                                SHA-512:AE78028EAF96E5B77DEFF0CD655360DB3A8058AC98B6753D9B77D629EDFFC582999A22A7075B9F5BA83EE65DA093E2CCB0EEAA4049898910D7AF517FDE60B28E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Bindings for ttk::panedwindow widget...#....namespace eval ttk::panedwindow {.. variable State.. array set State {...pressed 0.. .pressX.-...pressY.-...sash .-...sashPos -.. }..}....## Bindings:..#..bind TPanedwindow <Button-1> ..{ ttk::panedwindow::Press %W %x %y }..bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }..bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }....bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }..# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>..bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }....## Sash movement:..#..proc ttk::panedwindow::Press {w x y} {.. variable State.... set sash [$w identify $x $y].. if {$sash eq ""} {.. .set State(pressed) 0...return.. }.. set State(pressed) .1.. set State(pressX) .$x.. set

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\progress.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1138
                                                                                                                                                                                                                                                Entropy (8bit):4.763501917862434
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:nJ8v3O0NSiio0pNFVkIks0ImxlnINgDImSgGINSyWghT:JFqS/o03fkxs0Rn+gD4v+S2F
                                                                                                                                                                                                                                                MD5:DBF3BF0E8F04E9435E9561F740DFC700
                                                                                                                                                                                                                                                SHA1:C7619A05A834EFB901C57DCFEC2C9E625F42428F
                                                                                                                                                                                                                                                SHA-256:697CC0A75AE31FE9C2D85FB25DCA0AFA5D0DF9C523A2DFAD2E4A36893BE75FBA
                                                                                                                                                                                                                                                SHA-512:D3B323DFB3EAC4A78DA2381405925C131A99C6806AF6FD8041102162A44E48BF166982A4AE4AA142A14601736716F1A628D9587E292FA8E4842BE984374CC192
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Ttk widget set: progress bar utilities...#....namespace eval ttk::progressbar {.. variable Timers.;# Map: widget name -> after ID..}....# Autoincrement --..#.Periodic callback procedure for autoincrement mode..#..proc ttk::progressbar::Autoincrement {pb steptime stepsize} {.. variable Timers.... if {![winfo exists $pb]} {.. .# widget has been destroyed -- cancel timer...unset -nocomplain Timers($pb)...return.. }.... set Timers($pb) [after $steptime \.. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].... $pb step $stepsize..}....# ttk::progressbar::start --..#.Start autoincrement mode. Invoked by [$pb start] widget code...#..proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {.. variable Timers.. if {![info exists Timers($pb)]} {...Autoincrement $pb $steptime $stepsize.. }..}....# ttk::progressbar::stop --..#.Cancel autoincrement mode. Invoked by [$pb stop] widget code...#..proc ttk::progressbar::stop {pb} {.. variabl

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\scale.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2787
                                                                                                                                                                                                                                                Entropy (8bit):4.795451191784129
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:IKADAzizZIcAlRqucObmn4AzyVN2AJyhAzukPNP:IHIBRqupmLSZkklP
                                                                                                                                                                                                                                                MD5:F1C33CC2D47115BBECD2E7C2FCB631A7
                                                                                                                                                                                                                                                SHA1:0123A961242ED8049B37C77C726DB8DBD94C1023
                                                                                                                                                                                                                                                SHA-256:B909ADD0B87FA8EE08FD731041907212A8A0939D37D2FF9B2F600CD67DABD4BB
                                                                                                                                                                                                                                                SHA-512:96587A8C3555DA1D810010C10C516CE5CCAB071557A3C8D9BD65C647C7D4AD0E35CBED0788F1D72BAFAC8C84C7E2703FC747F70D9C95F720745A1FC4A701C544
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# Bindings for the TScale widget....namespace eval ttk::scale {.. variable State.. array set State {...dragging 0.. }..}....bind TScale <Button-1> { ttk::scale::Press %W %x %y }..bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }....bind TScale <Button-2> { ttk::scale::Jump %W %x %y }..bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }....bind TScale <Button-3> { ttk::scale::Jump %W %x %y }..bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }....## Keyboard navigation bindings:..#..bind TScale <<LineStart>> { %W set [%W cget -from] }..bind TScale <<LineEnd>> { %W set [%W cget -to] }....bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }..bin

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\scrollbar.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3285
                                                                                                                                                                                                                                                Entropy (8bit):4.979174619784594
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:tyASEji8RYQ8FGD7BDos9Q1TBfvq/HKTh9lkHv8T/mAezeLEAAFULxZh4x:eIi8qFu2d11XlhfkPcczeLS4Zm
                                                                                                                                                                                                                                                MD5:3FB31A225CEC64B720B8E579582F2749
                                                                                                                                                                                                                                                SHA1:9C0151D9E2543C217CF8699FF5D4299A72E8F13C
                                                                                                                                                                                                                                                SHA-256:6EAA336B13815A7FC18BCD6B9ADF722E794DA2888D053C229044784C8C8E9DE8
                                                                                                                                                                                                                                                SHA-512:E6865655585E3D2D6839B56811F3FD86B454E8CD44E258BB1AC576AD245FF8A4D49FBB7F43458BA8A6C9DAAC8DFA923A176F0DD8A9976A11BEA09E6E2D17BF45
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Bindings for TScrollbar widget..#....namespace eval ttk::scrollbar {.. variable State.. # State(xPress).--.. # State(yPress).-- initial position of mouse at start of drag... # State(first).-- value of -first at start of drag...}....bind TScrollbar <Button-1> ..{ ttk::scrollbar::Press %W %x %y }..bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }....bind TScrollbar <Button-2> ..{ ttk::scrollbar::Jump %W %x %y }..bind TScrollbar <B2-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-2>.{ ttk::scrollbar::Release %W %x %y }....# Redirect scrollwheel bindings to the scrollbar widget..#..# The shift-bindings scroll left/right (not up/down)..# if a widget has both possibilities..set eventList [list <MouseWheel> <Shift-MouseWheel>]..switch [tk windowingsystem] {.. aqua {.. lappend eventList <Option-MouseWheel> <Shift-Option-MouseWheel>.. }.. x11 {..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\sizegrip.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2503
                                                                                                                                                                                                                                                Entropy (8bit):4.830288003879418
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:naLvMnAqeYQWYh7FvBrrbnMCfY/aVAbAigWAuFM0PfWAX20:nWQapprPnJY/8A8iRFdPtj
                                                                                                                                                                                                                                                MD5:DD6A1737B14D3F7B2A0B4F8BE99C30AF
                                                                                                                                                                                                                                                SHA1:E6B06895317E73CD3DC78234DD74C74F3DB8C105
                                                                                                                                                                                                                                                SHA-256:E92D77B5CDCA2206376DB2129E87E3D744B3D5E31FDE6C0BBD44A494A6845CE1
                                                                                                                                                                                                                                                SHA-512:B74AE92EDD53652F8A3DB0D84C18F9CE9069805BCAB0D3C2DBB537D7C241AA2681DA69B699D88A10029798D7B5BC015682F64699BA475AE6A379EEF23B48DAAF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Sizegrip widget bindings...#..# Dragging a sizegrip widget resizes the containing toplevel...#..# NOTE: the sizegrip widget must be in the lower right hand corner...#....switch -- [tk windowingsystem] {.. x11 -.. win32 {...option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault.. }.. aqua {.. .# Aqua sizegrips use default Arrow cursor... }..}....namespace eval ttk::sizegrip {.. variable State.. array set State {...pressed .0...pressX ..0...pressY ..0...width ..0...height ..0...widthInc.1...heightInc.1.. resizeX 1.. resizeY 1...toplevel .{}.. }..}....bind TSizegrip <Button-1> ..{ ttk::sizegrip::Press.%W %X %Y }..bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }..bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }....proc ttk::sizegrip::Press {W X Y} {.. variable State.... if {[$W instate disabled]} { return }.... set top [winfo toplevel $W].... # If the toplevel is not resi

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\spinbox.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5003
                                                                                                                                                                                                                                                Entropy (8bit):5.055050310142795
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
                                                                                                                                                                                                                                                MD5:9C2833FAA9248F09BC2E6AB1BA326D59
                                                                                                                                                                                                                                                SHA1:F13CF048FD706BBB1581DC80E33D1AAD910D93E8
                                                                                                                                                                                                                                                SHA-256:DF286BB59F471AA1E19DF39AF0EF7AA84DF9F04DC4A439A747DD8BA43C300150
                                                                                                                                                                                                                                                SHA-512:5FF3BE1E3D651C145950C3FC5B8C2E842211C937D1042173964383D4D59ECF5DD0EC39FF7771D029716F2D895F0B1A72591EF3BF7947FE64D4D6DB5F0B8ABFFB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# ttk::spinbox bindings..#....namespace eval ttk::spinbox { }....### Spinbox bindings...#..# Duplicate the Entry bindings, override if needed:..#....ttk::copyBindings TEntry TSpinbox....bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }..bind TSpinbox <Button-1> ..{ ttk::spinbox::Press %W %x %y }..bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }..bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }..bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click....bind TSpinbox <Up>...{ event generate %W <<Increment>> }..bind TSpinbox <Down> ...{ event generate %W <<Decrement>> }....bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }..bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }....ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]....## Motion --..#.Sets cursor...#..proc ttk::spinbox::Motion {w x y} {.. variable State.. ttk::saveCursor $w State(userConfCursor) [ttk::cursor text].. if { [$w ide

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\treeview.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10180
                                                                                                                                                                                                                                                Entropy (8bit):4.886259798213254
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
                                                                                                                                                                                                                                                MD5:F705B3A292D02061DA0ABB4A8DD24077
                                                                                                                                                                                                                                                SHA1:FD75C2250F6F66435444F7DEEF383C6397ED2368
                                                                                                                                                                                                                                                SHA-256:C88B60FFB0F72E095F6FC9786930ADD7F9ED049EABC713F889F9A7DA516E188C
                                                                                                                                                                                                                                                SHA-512:09817638DD3D3D5C57FA630C7EDF2F19C3956C9BD264DBF07627FA14A03AECD22D5A5319806E49EF1030204FADEF17C57CE8EAE4378A319AD2093321D9151C8F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# ttk::treeview widget bindings and utilities...#....namespace eval ttk::treeview {.. variable State.... # Enter/Leave/Motion.. #.. set State(activeWidget) .{}.. set State(activeHeading) .{}.... # Press/drag/release:.. #.. set State(pressMode) .none.. set State(pressX)..0.... # For pressMode == "resize".. set State(resizeColumn).#0.... # For pressmode == "heading".. set State(heading) .{}..}....### Widget bindings...#....bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }..bind Treeview.<B1-Leave>..{ #nothing }..bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}..bind Treeview.<Button-1> ..{ ttk::treeview::Press %W %x %y }..bind Treeview.<Double-Button-1> .{ ttk::treeview::DoubleClick %W %x %y }..bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }..bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }..bind Treeview .<Up> ..{ ttk::treeview::Keynav %W up }..bind Treeview .<Down> ..{ ttk::treeview

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\ttk.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4993
                                                                                                                                                                                                                                                Entropy (8bit):4.954034141173847
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
                                                                                                                                                                                                                                                MD5:AF45B2C8B43596D1BDECA5233126BD14
                                                                                                                                                                                                                                                SHA1:A99E75D299C4579E10FCDD59389B98C662281A26
                                                                                                                                                                                                                                                SHA-256:2C48343B1A47F472D1A6B9EE8D670CE7FB428DB0DB7244DC323FF4C7A8B4F64B
                                                                                                                                                                                                                                                SHA-512:C8A8D01C61774321778AB149F6CA8DDA68DB69133CB5BA7C91938E4FD564160ECDCEC473222AFFB241304A9ACC73A36B134B3A602FD3587C711F2ADBB64AFA80
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Ttk widget set initialization script...#....### Source library scripts...#....namespace eval ::ttk {.. variable library.. if {![info exists library]} {...set library [file dirname [info script]].. }..}....source -encoding utf-8 [file join $::ttk::library fonts.tcl]..source -encoding utf-8 [file join $::ttk::library cursors.tcl]..source -encoding utf-8 [file join $::ttk::library utils.tcl]....## ttk::deprecated $old $new --..#.Define $old command as a deprecated alias for $new command..#.$old and $new must be fully namespace-qualified...#..proc ttk::deprecated {old new} {.. interp alias {} $old {} ttk::do'deprecate $old $new..}..## do'deprecate --..#.Implementation procedure for deprecated commands --..#.issue a warning (once), then re-alias old to new...#..proc ttk::do'deprecate {old new args} {.. deprecated'warning $old $new.. interp alias {} $old {} $new.. uplevel 1 [linsert $args 0 $new]..}....## deprecated'warning --..#.Gripe about use of deprecated comman

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\utils.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8624
                                                                                                                                                                                                                                                Entropy (8bit):5.001791071900077
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LlJWQl8p7M+R5:rw0+WmpWxa/w9nlJHu
                                                                                                                                                                                                                                                MD5:51086BC3315A4AE4A8591A654CFC3CEA
                                                                                                                                                                                                                                                SHA1:2AC08309C63575B7A01FA62D3C262643CD8C823A
                                                                                                                                                                                                                                                SHA-256:4AA041C050758B3331DC395381F7FBCE81E387908FC7A3C6107C4E7140F56F2E
                                                                                                                                                                                                                                                SHA-512:6D69F7EAC9D5AF3B3EA85AE3E74BDFA6278789502D5E35EFE94349BFC543503BE7540D783D2632E349DD53F21074C702AC1FC487EE70C74234A08397F7238723
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Utilities for widget implementations...#....### Focus management...#..# See also: #1516479..#....## ttk::takefocus --..#.This is the default value of the "-takefocus" option..#.for ttk::* widgets that participate in keyboard navigation...#..# NOTES:..#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable]..#.if -takefocus is 1, empty, or missing; but not if it's a..#.script prefix, so we have to check that here as well...#..#..proc ttk::takefocus {w} {.. expr {[$w instate !disabled] && [winfo viewable $w]}..}....## ttk::GuessTakeFocus --..#.This routine is called as a fallback for widgets..#.with a missing or empty -takefocus option...#..#.It implements the same heuristics as tk::FocusOK...#..proc ttk::GuessTakeFocus {w} {.. # Don't traverse to widgets with '-state disabled':.. #.. if {![catch {$w cget -state} state] && $state eq "disabled"} {...return 0.. }.... # Allow traversal to widgets with explicit key or focus bindings:.. #.. if {[regexp {Key|F

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\vistaTheme.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):9710
                                                                                                                                                                                                                                                Entropy (8bit):4.6639701588183895
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:BktY1F+qXd95WSZaHFHRE3GRKFh2oaoT/ezKpqvYMHab:V1F+cd95WSZuhRE34KbPmKmY2ab
                                                                                                                                                                                                                                                MD5:0AA7F8B43C3E07F3A4DA07FC6DF9A1B0
                                                                                                                                                                                                                                                SHA1:153AFB735B10BBA16CFBE161777232F983845D90
                                                                                                                                                                                                                                                SHA-256:EC5F203C69DF390E9B99944CF3526D6E77DC6F68E9B1A029F326A41AFED1EF81
                                                                                                                                                                                                                                                SHA-512:5406553211CD6714C98EF7765ABD46424CCB013343EFF693FDD3AE6E0AAE9B5983446E0E1CC706D6B2C285084BF83D397306D3D52028CBBCFB8F369857C5B69C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Settings for Microsoft Windows Vista and Server 2008..#....# The Vista theme can only be defined on Windows Vista and above. The theme..# is created in C due to the need to assign a theme-enabled function for..# detecting when themeing is disabled. On systems that cannot support the..# Vista theme, there will be no such theme created and we must not..# evaluate this script.....if {"vista" ni [ttk::style theme names]} {.. return..}....namespace eval ttk::theme::vista {.... ttk::style theme settings vista {.... .ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\winTheme.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2865
                                                                                                                                                                                                                                                Entropy (8bit):4.917847108902527
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:b69VhW2gL5FPVWRzQsVqrEuF3yYrf7rfJF8xUqBgLt6g3ktO5jo4+iZ6O2htYtCW:bbXl+CEqZNNSxU0Ht2MR7W
                                                                                                                                                                                                                                                MD5:769C0719A4044F91E7D132A25291E473
                                                                                                                                                                                                                                                SHA1:6FB07B0C887D443A43FB15D5728920B578171219
                                                                                                                                                                                                                                                SHA-256:AE82BCCCE708FF9C303CBCB3D4CC3FF5577A60D5B23822EA79E3E07CCE3CBBD1
                                                                                                                                                                                                                                                SHA-512:47FED061DDC6B4EB63EF77901D0094FF2EBB1BAFACB3F44FBF13FB59DEA1EC83985B2862086ECF1A7957819A88A0FAA144B35F16BEA9356BBD9775070D42E636
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Settings for 'winnative' theme...#....namespace eval ttk::theme::winnative {.. ttk::style theme settings winnative {.....ttk::style configure "." \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -fieldbackground SystemWindow \... -insertcolor SystemWindowText \... -troughcolor SystemScrollbar \... -font TkDefaultFont \... ;.....ttk::style map "." -foreground [list disabled SystemGrayText] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -relief raised -shiftrelief 1...ttk::style configure TCheckbutton -padding "2 4"...ttk::style configure TRadiobutton -padding "2 4"...ttk::style configure TMenubutton \... -padding "8 4" -arrowsize 3 -relief raised.....ttk::style map TButton -relief {{!disabled pressed} sunken}.....ttk::style configure TEntry \... -padding 2 -select

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\ttk\xpTheme.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2103
                                                                                                                                                                                                                                                Entropy (8bit):4.9805308941424355
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:aaiIu89VhW2gLRWJyO514rf+rfzxTrf/MW+iZ6O2htYtCp:XoXAk21nxQ7p
                                                                                                                                                                                                                                                MD5:162F30D2716438C75EA16B57E6F63088
                                                                                                                                                                                                                                                SHA1:3F626FF0496BB16B27106BED7E38D1C72D1E3E27
                                                                                                                                                                                                                                                SHA-256:AEDB21C6B2909A4BB4686837D2126E521A8CC2B38414A4540387B801EBD75466
                                                                                                                                                                                                                                                SHA-512:6EBF9648F1381D04F351BB469B6E3A38F3D002189C92EAF80A18D65632037FF37D34EC8814BBF7FAE34553645BFC13985212F24684EE8C4E205729B975C88C97
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:#..# Settings for 'xpnative' theme..#....namespace eval ttk::theme::xpnative {.... ttk::style theme settings xpnative {.....ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::style configure TCheckbutton -padding 2...ttk::style configure TMenubutton -padding {8 4}.....ttk::style configure TNotebook -tabmargins {2 2 2 0}...ttk::style map TNotebook.Tab \... -expand [list selected {2 2 2 2}].....ttk::style configure TLabelframe.Label -foreground "#0046d5".....# OR: -padding {3 3 3 6}, which some apps seem to use....ttk::style configure TEntry -padding {2 2 2 4}...ttk::

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\unsupported.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10521
                                                                                                                                                                                                                                                Entropy (8bit):5.0647027375963996
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:1Y3uWEXm/swEePmJhRAXd1hTHsHG2ML/9Lm2daM0Hu:8hodMiM0Hu
                                                                                                                                                                                                                                                MD5:508F7E258C04970FAE526990168CB773
                                                                                                                                                                                                                                                SHA1:33785204B18C0E0F5CDCB5B49399B5907351FDB8
                                                                                                                                                                                                                                                SHA-256:B463B366F139DDF7FED31F34C6D2341F9F27845A1A358011DFC801E1333B1828
                                                                                                                                                                                                                                                SHA-512:A12985B58DD1D46297119CED47B7F44EF4139CED6C36FD028E66DD657E5ED0663B744C679A5BF7A39B39D17A32E1280D2945F6B9AD59AEF20436F68040F6070C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# unsupported.tcl --..#..# Commands provided by Tk without official support. Use them at your..# own risk. They may change or go away without notice...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# ----------------------------------------------------------------------..# Unsupported compatibility interface for folks accessing Tk's private..# commands and variable against recommended usage...# ----------------------------------------------------------------------....namespace eval ::tk::unsupported {.... # Map from the old global names of Tk private commands to their.. # new namespace-encapsulated names..... variable PrivateCommands.. array set PrivateCommands {...tkButtonAutoInvoke..::tk::ButtonAutoInvoke...tkButtonDown...::tk::ButtonDown...tkButtonEnter...::tk::ButtonEnter...tkButtonInvoke...::tk::ButtonInvoke...tkButtonLeave...::tk::ButtonLeave...tkButtonUp...::tk::ButtonUp...tk

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tk_data\xmfbox.tcl

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):26991
                                                                                                                                                                                                                                                Entropy (8bit):4.974180990171971
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:0BLzjXhss64XKNFXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oP9jNR:0BvjXoFCB3flLCRE5phLCP3xWq8vWTod
                                                                                                                                                                                                                                                MD5:FA99EF44FAA88A6BA1967A1257DEB97B
                                                                                                                                                                                                                                                SHA1:CC99DBF678F4169A90ACC5A89C6F8DAB48052EC6
                                                                                                                                                                                                                                                SHA-256:C4722EADEDE763FA52E7937D40067B0F8EB86B7A4B707F90212ED3E5289690D0
                                                                                                                                                                                                                                                SHA-512:3AF16095784908A444CD61EEF178A30B9FED9C20AA91D94044A3AECB6047267FB80BCE790FC1F28FB19AEF664A6618FD832612F541FDADCC34B6C01E92E5EA40
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# xmfbox.tcl --..#..#.Implements the "Motif" style file selection dialog for the..#.Unix platform. This implementation is used only if the..#."::tk_strictMotif" flag is set...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Scriptics Corporation..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}......# ::tk::MotifFDialog --..#..#.Implements a file dialog similar to the standard Motif file..#.selection box...#..# Arguments:..#.type.."open" or "save"..#.args..Options parsed by the procedure...#..# Results:..#.When -multiple is set to 0, this returns the absolute pathname..#.of the selected file. (NOTE: This is not the same as a single..#.element list.)..#..#.When -multiple is set to > 0, this returns a Tcl list of absolute..# pathnames. The argument for -multiple is ignored, but for consistency..#

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_tkinter.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):66328
                                                                                                                                                                                                                                                Entropy (8bit):6.295486583134031
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:dGpS27sIvGJdk7YeY7S81CpnHcKWlI1OSs7Sy+xe:gpVp7xKSppnHcFlI1OSsz
                                                                                                                                                                                                                                                MD5:E38A6B96F5CC200F21DA22D49E321DA3
                                                                                                                                                                                                                                                SHA1:4EA69D2B021277AB0B473CFD44E4BFD17E3BAC3B
                                                                                                                                                                                                                                                SHA-256:F0EBDF2CA7B33C26B8938EFA59678068D3840957EE79D2B3C576437F8F913F20
                                                                                                                                                                                                                                                SHA-512:3DF55CDD44EA4789FB2DE9672F421B7FF9AD798917417DCB5B1D8575804306FB7636D436965598085D2E87256ECB476ED69DF7AF05986F05B9F4A18EED9629E2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s............jQ...................................j....Ni.....................=..........Rich...........PE..d......f.........." ...(.n...j............................................................`.............................................P.............................../......0......T...............................@............................................text....l.......n.................. ..`.rdata...B.......D...r..............@..@.data... ...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\_wmi.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):37656
                                                                                                                                                                                                                                                Entropy (8bit):6.341257574556273
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:r/mqQhTcYsjNxO0tI1Ci75YiSyvNhAMxkE9x2:Dm7GFNxO0tI1CiF7SynxRI
                                                                                                                                                                                                                                                MD5:BED7B0CED98FA065A9B8FE62E328713F
                                                                                                                                                                                                                                                SHA1:E329EBCA2DF8889B78CE666E3FB909B4690D2DAA
                                                                                                                                                                                                                                                SHA-256:5818679010BB536A3D463EEEE8CE203E880A8CD1C06BF1CB6C416AB0DC024D94
                                                                                                                                                                                                                                                SHA-512:C95F7BB6CA9AFBA50BF0727E971DFF7326CE0E23A4BFA44D62F2ED67ED5FEDE1B018519DBFA0ED3091D485ED0ACE68B52DD0BB2921C9C1E3BC1FA875CD3D2366
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.L...L...L...E..J.......H.......H.......D...Y...N.......Q.......K...L...........M...Y...M...Y...M...Y...M...Y...M...RichL...........PE..d....f.........." ...(.*...<.......(..............................................@.....`..........................................V..H...HV..................x....d.../......t...dG..T............................C..@............@.......S..@....................text...n(.......*.................. ..`.rdata..4 ...@..."..................@..@.data........p.......P..............@....pdata..x............T..............@..@.rsrc................X..............@..@.reloc..t............b..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\base_library.zip

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1332769
                                                                                                                                                                                                                                                Entropy (8bit):5.586540075838612
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:VHlJGUqQlLmgBvc+fYNXPh26UZWAzyX7j7YQqPQCxf2idmSP/Hg1d2R1RbtRwvw:VHlJGUDa+zy/7UlcidmSPvaMHtRwvw
                                                                                                                                                                                                                                                MD5:242A4D3404414A9E8ED1CA1A72E8039C
                                                                                                                                                                                                                                                SHA1:B1FD68D13CC6D5B97DC3EA8E2BE1144EA2C3ED50
                                                                                                                                                                                                                                                SHA-256:CB98F93EDE1F6825699EF6E5F11A65B00CDBC9FDFB34F7209B529A6E43E0402D
                                                                                                                                                                                                                                                SHA-512:CCA8E18CC41300E204AEE9E44D68FFE9808679B7DBF3BEC9B3885257CADCCFF1DF22A3519CC8DB3B3C557653C98BAC693BF89A1E6314EF0E0663C76BE2BF8626
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:PK..........!./gJ.O...O......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z*..e*........Z*..e.e*........Z+e*jY............................[*d...Z-..e-........

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\certifi\cacert.pem

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):299427
                                                                                                                                                                                                                                                Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                                MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                                SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                                SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                                SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\charset_normalizer\md.cp312-win_amd64.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10752
                                                                                                                                                                                                                                                Entropy (8bit):4.817893239381772
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:MRv9XFCk2z1/t12iwU5usJFcCyD9cqgE:aVVC5djuUFJKtgE
                                                                                                                                                                                                                                                MD5:71D96F1DBFCD6F767D81F8254E572751
                                                                                                                                                                                                                                                SHA1:E70B74430500ED5117547E0CD339D6E6F4613503
                                                                                                                                                                                                                                                SHA-256:611E1B4B9ED6788640F550771744D83E404432830BB8E3063F0B8EC3B98911AF
                                                                                                                                                                                                                                                SHA-512:7B10E13B3723DB0E826B7C7A52090DE999626D5FA6C8F9B4630FDEEF515A58C40660FA90589532A6D4377F003B3CB5B9851E276A0B3C83B9709E28E6A66A1D32
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d... $.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):124928
                                                                                                                                                                                                                                                Entropy (8bit):5.935676608756784
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:BETt3OiaqGB7QNX6Pq4a461TDqFRgMzrOH+d3gdy2iIeP/j3bhouROm:Bmt+is7QNqP1ab1TGb9g/iI4bhouROm
                                                                                                                                                                                                                                                MD5:D8F690EAE02332A6898E9C8B983C56DD
                                                                                                                                                                                                                                                SHA1:112C1FE25E0D948F767E02F291801C0E4AE592F0
                                                                                                                                                                                                                                                SHA-256:C6BB8CAD80B8D7847C52931F11D73BA64F78615218398B2C058F9B218FF21CA9
                                                                                                                                                                                                                                                SHA-512:E732F79F39BA9721CC59DBE8C4785FFD74DF84CA00D13D72AFA3F96B97B8C7ADF4EA9344D79EE2A1C77D58EF28D3DDCC855F3CB13EDDA928C17B1158ABCC5B4A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB....................7...............7.......7.......7.......6..........C....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........B.......................................0............`.............................................d.................................... ......@...................................@............P...............................text....>.......@.................. ..`.rdata..PY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography-43.0.1.dist-info\INSTALLER

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography-43.0.1.dist-info\METADATA

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5440
                                                                                                                                                                                                                                                Entropy (8bit):5.074342830021076
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:DlaQIUQIhQIKQILbQIRIaMPktjaVxsxA2TtLDmplH7dwnqTIvrUmA0JQTQCQx5KN:LcPuP1srTtLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                                                                MD5:554DC6138FDBF98B7F1EDFE207AF3D67
                                                                                                                                                                                                                                                SHA1:B6C806E2AFF9A0F560916A90F793348DBF0514BA
                                                                                                                                                                                                                                                SHA-256:0064A9B5FD2AC18605E512EF7127318AD9CF259E9445488C169F237A590602E1
                                                                                                                                                                                                                                                SHA-512:3A71B533874F4D0F94F15192791D2FA4DF9E8EBF184C711F1D4FA97230C04764C1C9A93258355B08107E5B72053C6901E883E3DB577E8A204D5B9EB3F8BC7BFC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.1.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography-43.0.1.dist-info\RECORD

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):15579
                                                                                                                                                                                                                                                Entropy (8bit):5.567434003079107
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:bX1ToLbz5jF4E9VqhXJZ4WPB6s7B0Ppz+NX6in5Lqw/I+B:bXeLbhCEsJrPB6s7B0Ppz+96innVB
                                                                                                                                                                                                                                                MD5:E8478B758300439BF58613F2A3A2676C
                                                                                                                                                                                                                                                SHA1:39ED064E67212A54E4B8D1C909E6AD2ACF48025D
                                                                                                                                                                                                                                                SHA-256:5ADEAA62D3045659DDF79324823AA3BCB1CA78F264442D6F6F6B9C8A8470A634
                                                                                                                                                                                                                                                SHA-512:D7029823DC5585FBE885DDB52EED2D02D1584EB945EF23916391201FCBD17DF0B14F338BDFC6E81318297F831CA99796423206F781373857317E068F0C0B321C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:cryptography-43.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.1.dist-info/METADATA,sha256=AGSptf0qwYYF5RLvcScxitnPJZ6URUiMFp8jelkGAuE,5440..cryptography-43.0.1.dist-info/RECORD,,..cryptography-43.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-43.0.1.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.1.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.1.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.1.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=pY_pmYXjJTK-LjfCu7ot0NMj0QC2dkD1dCPyV8QjISM,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__ini

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography-43.0.1.dist-info\WHEEL

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):94
                                                                                                                                                                                                                                                Entropy (8bit):5.016084900984752
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                                                                MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                                                                SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                                                                SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                                                                SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography-43.0.1.dist-info\license_files\LICENSE

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):197
                                                                                                                                                                                                                                                Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                                                MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                                                SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                                                SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                                                SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography-43.0.1.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11360
                                                                                                                                                                                                                                                Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                                                MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                                                SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                                                SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                                                SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography-43.0.1.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1532
                                                                                                                                                                                                                                                Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                                                MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                                                SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                                                SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                                                SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7900672
                                                                                                                                                                                                                                                Entropy (8bit):6.519460416205842
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:Hvisa2OcIo0UYN1YA2sBCT7I0XIU6iOGtlqNVwASO0AIjoI+b0vjemXSKSDhxlT3:Pi/2PTYDBCT7NY+gTNxY7GbdJ295x
                                                                                                                                                                                                                                                MD5:81AD4F91BB10900E3E2E8EAF917F42C9
                                                                                                                                                                                                                                                SHA1:840F7AEF02CDA6672F0E3FC7A8D57F213DDD1DC6
                                                                                                                                                                                                                                                SHA-256:5F20D6CEC04685075781996A9F54A78DC44AB8E39EB5A2BCF3234E36BEF4B190
                                                                                                                                                                                                                                                SHA-512:11CD299D6812CDF6F0A74BA86EB44E9904CE4106167EBD6E0B81F60A5FCD04236CEF5CFF81E51ED391F5156430663056393DC07353C4A70A88024194768FFE9D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..(...(...(...!...:...8...*...8...,...8... ...8...9...c..&...G...*...(...+...`...V...(.....`...)...`...)...Rich(...........................PE..d....j.f.........." ...).`Z..V........X.......................................x...........`.........................................p.r.......r...............t...............x......Cj.T....................Cj.(....Aj.@............pZ..............................text...._Z......`Z................. ..`.rdata..ZR...pZ..T...dZ.............@..@.data....+....r.......r.............@....pdata........t.......s.............@..@.reloc........x.......w.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\libcrypto-3.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5191960
                                                                                                                                                                                                                                                Entropy (8bit):5.962142634441191
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
                                                                                                                                                                                                                                                MD5:E547CF6D296A88F5B1C352C116DF7C0C
                                                                                                                                                                                                                                                SHA1:CAFA14E0367F7C13AD140FD556F10F320A039783
                                                                                                                                                                                                                                                SHA-256:05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
                                                                                                                                                                                                                                                SHA-512:9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\libffi-8.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):39696
                                                                                                                                                                                                                                                Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                                MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                                SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                                SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                                SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\libssl-3.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):787224
                                                                                                                                                                                                                                                Entropy (8bit):5.609561366841894
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
                                                                                                                                                                                                                                                MD5:19A2ABA25456181D5FB572D88AC0E73E
                                                                                                                                                                                                                                                SHA1:656CA8CDFC9C3A6379536E2027E93408851483DB
                                                                                                                                                                                                                                                SHA-256:2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
                                                                                                                                                                                                                                                SHA-512:DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%.*..........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D).......*.................. ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\pyexpat.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):202008
                                                                                                                                                                                                                                                Entropy (8bit):6.367263484296302
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:4nwukKYdeMwj1XQk67ZLXni8Es7sp0HhiviBvDKax:KrqiviMax
                                                                                                                                                                                                                                                MD5:815F1BDABB79C6A12B38D84AA343196D
                                                                                                                                                                                                                                                SHA1:916483149875A5E20C6046CEFFEF62DD6089DDD5
                                                                                                                                                                                                                                                SHA-256:31712AE276E2CED05ECDA3E1C08FBBCC2CFF8474A972626ABA55F7797F0ED8C9
                                                                                                                                                                                                                                                SHA-512:1078E7E48B6F6ED160AE2BCCF80A43A5F1CCA769B8A690326E112BF20D7F3D018F855F6AA3B56D315DC0853472E0AFFCFE8E910B5CE69CE952983CFAA496C21D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@..@..@..8N..@.:...@.:...@.:...@.:...@.....@..8..@..@..@.....@.....@..."..@.....@.Rich.@.........PE..d.....f.........." ...(..................................................... ......?.....`............................................P...@............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...p ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\python3.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):68376
                                                                                                                                                                                                                                                Entropy (8bit):6.148788033723542
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/D:BDmF61JFn+/O/BI1L057Sy+xF
                                                                                                                                                                                                                                                MD5:8DBE9BBF7118F4862E02CD2AAF43F1AB
                                                                                                                                                                                                                                                SHA1:935BC8C5CEA4502D0FACF0C49C5F2B9C138608ED
                                                                                                                                                                                                                                                SHA-256:29F173E0147390A99F541BA0C0231FDD7DFBCA84D0E2E561EF352BF1EC72F5DB
                                                                                                                                                                                                                                                SHA-512:938F8387DCC356012AC4A952D371664700B110F7111FCC24F5DF7D79791AE95BAD0DBAF77D2D6C86C820BFD48A6BDBE8858B7E7AE1A77DF88E596556C7135ED4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...Te..Te..Te...m..Te...e..Te.....Te...g..Te.Rich.Te.................PE..d......f.........." ...(..................................................................`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\python312.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6927640
                                                                                                                                                                                                                                                Entropy (8bit):5.765554952149868
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:Jc7/HNCHh0IWiUDFsx3hghs7g6kIPuch+Xe16/02yWYqiVx7qb4f4wmC36nhIVcF:JcBZhxsje2kUvid5E+vbHDMiEr/l9o
                                                                                                                                                                                                                                                MD5:CAE8FA4E7CB32DA83ACF655C2C39D9E1
                                                                                                                                                                                                                                                SHA1:7A0055588A2D232BE8C56791642CB0F5ABBC71F8
                                                                                                                                                                                                                                                SHA-256:8AD53C67C2B4DB4387D5F72EE2A3CA80C40AF444B22BF41A6CFDA2225A27BB93
                                                                                                                                                                                                                                                SHA-512:DB2190DA2C35BCEED0EF91D7553FF0DEA442286490145C3D0E89DB59BA1299B0851E601CC324B5F7FD026414FC73755E8EFF2EF5FB5EEB1C54A9E13E7C66DD0C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..*$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d......f.........." ...(..(..6B...............................................j......dj...`.........................................pdN.d....1O.......i......._.`I....i../... i..[..0.2.T.....................H.(....2.@............ (..............................text.....(.......(................. ..`.rdata..f7'.. (..8'...(.............@..@.data....J...`O......HO.............@....pdata..`I...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc...[... i..\...*h.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\select.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):31000
                                                                                                                                                                                                                                                Entropy (8bit):6.553885009751671
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:384:I8RVBC9t6Lhz64SHfZslDT90YBI1QGjHQIYiSy1pCQQRaAM+o/8E9VF0NytuSS:1GyqHfK1HBI1QGT5YiSyvXAMxkEm
                                                                                                                                                                                                                                                MD5:79CE1AE3A23DFF6ED5FC66E6416600CD
                                                                                                                                                                                                                                                SHA1:6204374D99144B0A26FD1D61940FF4F0D17C2212
                                                                                                                                                                                                                                                SHA-256:678E09AD44BE42FA9BC9C7A18C25DBE995A59B6C36A13EECC09C0F02A647B6F0
                                                                                                                                                                                                                                                SHA-512:A4E48696788798A7D061C0EF620D40187850741C2BEC357DB0E37A2DD94D3A50F9F55BA75DC4D95E50946CBAB78B84BA1FC42D51FD498640A231321566613DAA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d.....f.........." ...(.....2......................................................._....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11358
                                                                                                                                                                                                                                                Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                                                                MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                                                                SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                                                                SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                                                                SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4648
                                                                                                                                                                                                                                                Entropy (8bit):5.006900644756252
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
                                                                                                                                                                                                                                                MD5:98ABEAACC0E0E4FC385DFF67B607071A
                                                                                                                                                                                                                                                SHA1:E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
                                                                                                                                                                                                                                                SHA-256:6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
                                                                                                                                                                                                                                                SHA-512:F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2518
                                                                                                                                                                                                                                                Entropy (8bit):5.6307766747793275
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
                                                                                                                                                                                                                                                MD5:EB513CAFA5226DDA7D54AFDCC9AD8A74
                                                                                                                                                                                                                                                SHA1:B394C7AEC158350BAF676AE3197BEF4D7158B31C
                                                                                                                                                                                                                                                SHA-256:0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
                                                                                                                                                                                                                                                SHA-512:A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):91
                                                                                                                                                                                                                                                Entropy (8bit):4.687870576189661
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
                                                                                                                                                                                                                                                MD5:7D09837492494019EA51F4E97823D79F
                                                                                                                                                                                                                                                SHA1:7829B4324BB542799494131A270EC3BDAD4DEDEF
                                                                                                                                                                                                                                                SHA-256:9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
                                                                                                                                                                                                                                                SHA-512:A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):19
                                                                                                                                                                                                                                                Entropy (8bit):3.536886723742169
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:JSej0EBERG:50o4G
                                                                                                                                                                                                                                                MD5:A24465F7850BA59507BF86D89165525C
                                                                                                                                                                                                                                                SHA1:4E61F9264DE74783B5924249BCFE1B06F178B9AD
                                                                                                                                                                                                                                                SHA-256:08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
                                                                                                                                                                                                                                                SHA-512:ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:importlib_metadata.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (888)
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1335
                                                                                                                                                                                                                                                Entropy (8bit):4.226823573023539
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
                                                                                                                                                                                                                                                MD5:4CE7501F6608F6CE4011D627979E1AE4
                                                                                                                                                                                                                                                SHA1:78363672264D9CD3F72D5C1D3665E1657B1A5071
                                                                                                                                                                                                                                                SHA-256:37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
                                                                                                                                                                                                                                                SHA-512:A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4
                                                                                                                                                                                                                                                Entropy (8bit):1.5
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Mn:M
                                                                                                                                                                                                                                                MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                                SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                                SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                                SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:pip.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1107
                                                                                                                                                                                                                                                Entropy (8bit):5.115074330424529
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                                                                MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                                                                SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                                                                SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                                                                SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2153
                                                                                                                                                                                                                                                Entropy (8bit):5.088249746074878
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                                                                MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                                                                SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                                                                SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                                                                SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:CSV text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4557
                                                                                                                                                                                                                                                Entropy (8bit):5.714200636114494
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                                                                MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                                                                SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                                                                SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                                                                SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):81
                                                                                                                                                                                                                                                Entropy (8bit):4.672346887071811
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                                                                MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                                                                SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                                                                SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                                                                SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):104
                                                                                                                                                                                                                                                Entropy (8bit):4.271713330022269
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                                                                MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                                                                SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                                                                SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                                                                SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\tcl86t.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1816344
                                                                                                                                                                                                                                                Entropy (8bit):6.495049871908257
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:CAZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDR:CA0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDD
                                                                                                                                                                                                                                                MD5:3AE729942D15F4F48B1EA8C91880F1F4
                                                                                                                                                                                                                                                SHA1:D27596D14AF5ADEB02EDAB74859B763BF6AC2853
                                                                                                                                                                                                                                                SHA-256:FE62CA2B01B0EC8A609B48F165CA9C6A91653D3966239243AD352DD4C8961760
                                                                                                                                                                                                                                                SHA-512:355800E9152DAAD675428421B867B6D48E2C8F8BE9CA0284F221F27FAE198C8F07D90980E04D807B50A88F92FFB946DC53B7564E080E2E0684F7F6CCC84FF245
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......1.y+u..xu..xu..x...yw..x...xv..x...yx..x...y}..x...yq..x..yw..x|..xg..x...yt..x...yx..xu..x]..x...y...x...yt..x...xt..x...yt..xRichu..x........................PE..d...1,.c.........." ...!.............................................................j....`..............................................`.. _..h.......8................/..........................................`...@............0...............................text............................... ..`.rdata..|L...0...N..................@..@.data...."...........f..............@....pdata...............n..............@..@.rsrc...8............f..............@..@.reloc...............j..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\tcl8\8.4\platform-1.0.19.tm

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):11707
                                                                                                                                                                                                                                                Entropy (8bit):5.03328629946697
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:rXlm2LnoZ7k2mOEhYoKVtWD2xLsmF+MNlPQ4lJ+B0O0DgryYY/+zy7go:rXlm2Lng7kvF2VtWD2xLeMNT+B0O0Urk
                                                                                                                                                                                                                                                MD5:A0B269D76DB613C2D927EFA84FEE88E2
                                                                                                                                                                                                                                                SHA1:F9C7AD375F4D4223F0668FA1E2C4E5A83CAC2D03
                                                                                                                                                                                                                                                SHA-256:32348D51F3637F375B056FE99E9B4D89D85D45DB907847DC370BD72812A2E2FE
                                                                                                                                                                                                                                                SHA-512:5427762147825DC2ED3FEEE4011BBF2100932A4D93F3242CCAD15499C9DC39F42A82AEB42ED5DB5839560CD7AAE5D30621AC3694552FFC650A1F572CEE32FA54
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# -*- tcl -*-..# ### ### ### ######### ######### #########..## Overview....# Heuristics to assemble a platform identifier from publicly available..# information. The identifier describes the platform of the currently..# running tcl shell. This is a mixture of the runtime environment and..# of build-time properties of the executable itself...#..# Examples:..# <1> A tcl shell executing on a x86_64 processor, but having a..# wordsize of 4 was compiled for the x86 environment, i.e. 32..# bit, and loaded packages have to match that, and not the..# actual cpu...#..# <2> The hp/solaris 32/64 bit builds of the core cannot be..# distinguished by looking at tcl_platform. As packages have to..# match the 32/64 information we have to look in more places. In..# this case we inspect the executable itself (magic numbers,..# i.e. fileutil::magic::filetype)...#..# The basic information used comes out of the 'os' and 'machine'..# entries of the 'tcl_platform' array. A number of general and

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\tcl8\8.4\platform\shell-1.1.4.tm

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):6218
                                                                                                                                                                                                                                                Entropy (8bit):4.843141834641668
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:PV5U+VLnNUPVvH+knNUPVUHD5ngWftN+IgMufIdqi+g0SYiCXVDjqL:Nm6MFXN5uwq51iCFD2
                                                                                                                                                                                                                                                MD5:8ABC3029963E433D1D9865AAA7E1057B
                                                                                                                                                                                                                                                SHA1:A88091DC98B2FD0AE3A258B59F8BE43F41F04323
                                                                                                                                                                                                                                                SHA-256:0A6B4B109CFDFC4B40FBDEFDB2282F9B1AF3CC2F9624DD39958EEBD78781AFB2
                                                                                                                                                                                                                                                SHA-512:D5068375615A2200DDC13EEB852B2E21B7E4AA416FB7A0E97C98B8B106D7701792C523739E8BF266D2ABE411D4298A0B5B3884CFB9DF820FD4A2B61B22F9DECF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..# -*- tcl -*-..# ### ### ### ######### ######### #########..## Overview....# Higher-level commands which invoke the functionality of this package..# for an arbitrary tcl shell (tclsh, wish, ...). This is required by a..# repository as while the tcl shell executing packages uses the same..# platform in general as a repository application there can be..# differences in detail (i.e. 32/64 bit builds).....# ### ### ### ######### ######### #########..## Requirements....package require platform..namespace eval ::platform::shell {}....# ### ### ### ######### ######### #########..## Implementation....# -- platform::shell::generic....proc ::platform::shell::generic {shell} {.. # Argument is the path to a tcl shell..... CHECK $shell.. LOCATE base out.... set code {}.. # Forget any pre-existing platform package, it might be in.. # conflict with this one... lappend code {package forget platform}.. # Inject our platform package.. lappend code [list source $base]..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\tcl8\8.5\msgcat-1.6.1.tm

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):35136
                                                                                                                                                                                                                                                Entropy (8bit):4.945501767273492
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:768:m3xQvCzasI/rHPG2yfkZ0Kbh91iQ3Lnq5MIVYB8mbgijsPIWtw4qvUm:4xQvCzasIDHPG2yW0kJ32imXmUij6JjG
                                                                                                                                                                                                                                                MD5:BD4FF2A1F742D9E6E699EEEE5E678AD1
                                                                                                                                                                                                                                                SHA1:811AD83AFF80131BA73ABC546C6BD78453BF3EB9
                                                                                                                                                                                                                                                SHA-256:6774519F179872EC5292523F2788B77B2B839E15665037E097A0D4EDDDD1C6FB
                                                                                                                                                                                                                                                SHA-512:B77E4A68017BA57C06876B21B8110C636F9BA1DD0BA9D7A0C50096F3F6391508CF3562DD94ACEAF673113DBD336109DA958044AEFAC0AFB0F833A652E4438F43
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# msgcat.tcl --..#..#.This file defines various procedures which implement a..#.message catalog facility for Tcl programs. It should be..#.loaded with the command "package require msgcat"...#..# Copyright (c) 2010-2015 Harald Oehlmann...# Copyright (c) 1998-2000 Ajuba Solutions...# Copyright (c) 1998 Mark Harrison...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....package require Tcl 8.5-..# When the version number changes, be sure to update the pkgIndex.tcl file,..# and the installation directory in the Makefiles...package provide msgcat 1.6.1....namespace eval msgcat {.. namespace export mc mcexists mcload mclocale mcmax mcmset mcpreferences mcset\.. mcunknown mcflset mcflmset mcloadedlocales mcforgetpackage\... mcpackageconfig mcpackagelocale.... # Records the list of locales to search.. variable Loclist {}.... # List of currently loaded locales.. variable LoadedLoc

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\tcl8\8.5\tcltest-2.5.5.tm

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):107674
                                                                                                                                                                                                                                                Entropy (8bit):4.841458743618635
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:74s6YTLsaoi4N8uBPM5PP9AlGXJL/ciBh:7N6Y9oi4N8uBPM5PP9AYXJL/ciBh
                                                                                                                                                                                                                                                MD5:655EC828777244F9F048E0D08203482F
                                                                                                                                                                                                                                                SHA1:790446D04FE7BE12FD5DCF6E6FBD4C5A08C45C98
                                                                                                                                                                                                                                                SHA-256:35A88F56DF57E6AC6F2CCC4D193210FBB9BD224AC99670603E077DDF8C5610BC
                                                                                                                                                                                                                                                SHA-512:C249CAA5DA76A0B0876DD1BD201FF2D249D4FCD8467992C9DE51BA5A1C5471F98C10D69C46DF5B25DBA7941F4301B446D90CBF17BCCFB8B0ED27B22BF4DA20F3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# tcltest.tcl --..#..#.This file contains support code for the Tcl test suite. It..# defines the tcltest namespace and finds and defines the output..# directory, constraints available, output and error channels,..#.etc. used by Tcl tests. See the tcltest man page for more..#.details...#..# This design was based on the Tcl testing approach designed and..# initially implemented by Mary Ann May-Pumphrey of Sun..#.Microsystems...#..# Copyright . 1994-1997 Sun Microsystems, Inc...# Copyright . 1998-1999 Scriptics Corporation...# Copyright . 2000 Ajuba Solutions..# Contributions from Don Porter, NIST, 2002. (not subject to US copyright)..# All rights reserved.....package require Tcl 8.5-..;# -verbose line uses [info frame]..namespace eval tcltest {.... # When the version number changes, be sure to update the pkgIndex.tcl file,.. # and the install directory in the Makefiles. When the minor version.. # changes (new feature) be sure to update the man page

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\tcl8\8.6\http-2.9.8.tm

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):118419
                                                                                                                                                                                                                                                Entropy (8bit):4.888789841897662
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:RYY1IO/KuUhIW17zr1DLJuuBuFsj6aIsGc3e6xGxjndp72y4ebBxIQ30Ik:RbyOCuUv9r5LJmsjlxTxGxjndpCBeAQ0
                                                                                                                                                                                                                                                MD5:ACB85FEB97B27F1362E1D76B686D498F
                                                                                                                                                                                                                                                SHA1:92C370F838BD67C72E153FBF7AD05E26FF40A393
                                                                                                                                                                                                                                                SHA-256:7A30E7A49C1F6939537EB7A80CF2F5BC7A4969F2B2AD99BA4E26DB85BBC2FCC7
                                                                                                                                                                                                                                                SHA-512:EA504863386817E1B21549376148FD05C7EAF74F91A3A8DA97EFCF3784530ED3CF1910DF9B2431EC47D1175759CDEB1A0E9E9E02BBA94EC2123EAFB7CBD2B90A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# http.tcl --..#..#.Client-side HTTP for GET, POST, and HEAD commands. These routines can..#.be used in untrusted code that uses the Safesock security policy...#.These procedures use a callback interface to avoid using vwait, which..#.is not defined in the safe base...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....package require Tcl 8.6-..# Keep this in sync with pkgIndex.tcl and with the install directories in..# Makefiles..package provide http 2.9.8....namespace eval http {.. # Allow resourcing to not clobber existing data.... variable http.. if {![info exists http]} {...array set http {... -accept */*... -pipeline 1... -postfresh 0... -proxyhost {}... -proxyport {}... -proxyfilter http::ProxyRequired... -repost 0... -urlencoding utf-8... -zip 1...}...# We need a useragent string of this style or various servers will...# refuse to send us compressed content

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\tk86t.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1555736
                                                                                                                                                                                                                                                Entropy (8bit):6.1820383306760185
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:gJ3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdbo:yeFSpvzg0RwgVdF9EWyCzfdmHQnveD4Z
                                                                                                                                                                                                                                                MD5:966580716C0D6B7EEC217071A6DF6796
                                                                                                                                                                                                                                                SHA1:E3D2D4A7EC61D920130D7A745586CEB7AAD4184D
                                                                                                                                                                                                                                                SHA-256:AFC13FCE0690C0A4B449EC7ED4FB0233A8359911C1C0BA26A285F32895DBB3D2
                                                                                                                                                                                                                                                SHA-512:CF0675EA888A6D1547842BCFB27D45815B164337B4A285253716917EB157C6DF3CC97CBA8AD2AB7096E8F5131889957E0555BAE9B5A8B64745AC3D2F174E3224
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.P.=n>.=n>.=n>...?.?n>...;.1n>...:.5n>...=.9n>...:.>n>...:.<n>.4...-n>...?.(n>.=n?.wo>...6..n>...>.<n>.....<n>...<.<n>.Rich=n>.................PE..d...],.c.........." ...!............|...............................................4=....`..........................................?..L@..,...|........{...P..D......../.......E...T...............................S..@...............@............................text...h........................... ..`.rdata..0...........................@..@.data...............................@....pdata..D....P......................@..@.rsrc....{.......|..................@..@.reloc...E.......F...H..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\unicodedata.pyd

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1138456
                                                                                                                                                                                                                                                Entropy (8bit):5.461877321211646
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:FrEHdcM6hb/CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAa1:FrEXaCjfk7bPNfv42BN6yzUAa1
                                                                                                                                                                                                                                                MD5:B848E259FABAF32B4B3C980A0A12488D
                                                                                                                                                                                                                                                SHA1:DA2E864E18521C86C7D8968DB74BB2B28E4C23E2
                                                                                                                                                                                                                                                SHA-256:C65073B65F107E471C9BE3C699FB11F774E9A07581F41229582F7B2154B6FC3C
                                                                                                                                                                                                                                                SHA-512:4C6953504D1401FE0C74435BCEEBC5EC7BF8991FD42B659867A3529CEE5CC64DA54F1AB404E88160E747887A7409098F1A85A546BC40F12F0DDE0025408F9E27
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}.*..%.}..*|.!.}..*~. .}..*y.+.}..*x...}.6-|. .}.h.|.!.}.#.|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d....f.........." ...(.@..........0*.......................................p......]M....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79482\zlib1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):146712
                                                                                                                                                                                                                                                Entropy (8bit):6.609302620823316
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:7qLKjJj3yg1shVjm4OvfqnKAh2mrohmR5JHDbuNy:7qGEgSefI3roCDbV
                                                                                                                                                                                                                                                MD5:4FADEDA3C1DA95337B67D15C282D49D8
                                                                                                                                                                                                                                                SHA1:F49EE3256F8F5746515194114F7EF73D6B6141C0
                                                                                                                                                                                                                                                SHA-256:28484BCEA1E387C4A41564AF8F62C040FE203FE2491E415CE90F3D7F5C7AB013
                                                                                                                                                                                                                                                SHA-512:45634CAF9D9214F0E45E11A1539D8663B45527E1AE9282558B5FDB8465D90B0FABCF4C0E508504427A597BA390C029BC12068AC17D842FD0FCBB1886D252C6B1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...x.Oc..........."...'............P..........A.....................................W....`... ......................................@.......P..8......................../......................................(....................Q..p............................text...............................`..`.data...............................@....rdata...W.......X..................@..@.pdata..............................@..@.xdata....... ......................@..@.bss.........0...........................edata.......@......................@..@.idata..8....P......................@....CRT....X....`......................@....tls.........p......................@....rsrc...............................@....reloc..............................@..B................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5gfsuc51.rwr.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_autmwspf.snd.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mjmgphbp.pcv.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_twwg4utd.kpr.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\Desktop\BJZFPPWAPT.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969876068648522
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WZfR+JEq2nEwQoIcsUEiwuUyQWT6hnIV2cvpFA98q+epubJ8smPGRZuHg3oqvE:Ys12nEn1zbYmnIV9FZxwPiZ8ovE
                                                                                                                                                                                                                                                MD5:E12C8F025868B4C9C543D0EAD2B471A2
                                                                                                                                                                                                                                                SHA1:8B53D6D90E2D7856562734AAB0EF3AD032EAB59E
                                                                                                                                                                                                                                                SHA-256:5399D191DF11B492AF5FAA097772622F8857C6030D5141F9F51E668C9F8FB396
                                                                                                                                                                                                                                                SHA-512:4CB4D1896FC57F05F9E6E2C4F54A16AC1442631A94BE8E951748DA90187CFC174C0C8AFCFE344B68ED1364B80E3A2B37B909E829C8FD28B0FB5E68D0A5C8B2C8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EWEhLl_-6d8tV8pTtpNTHxx4EJo-Oy-GVTMn4SEeUF6MEScdWmVv0jsk5QInmUTYU9E7xI8mHhjh3PCuIojLNmrRuiEWNNisSVr_0sIFLpbJetToOG8YRn6gBuzgTYTh71hvbZQg1Sg5vslckKeU1St-nptUQKh_d4aLC7WAWK78CWpgOO9n6qatT-Mmibk6cp_wb5tuwYXAv5meyh0qIbyBxYzgmL3iYJSJ_YNKMkU_7uqPmqyuKQeMp4_dcVgtKUKbZk-XkOaM1Iy2TsdNTLQL5Y-WGbmLkmlJ73MFF4Xqy02_zx4ORzoR0EkmRlsV84sqvcehsPBgf6u9cdY0ey7wMkl6XdJNcE8vqFP1cFvNQwDTZD6OvjggxSGwmPhYBFm1Ou4xoveyR8vTBGfILPYtc-yVL-vwT6E5i9-GO9ZTvBVPiOYTdMYA0KZmExivDIgdaEMpSx3DAaUFToPAPw_5UQWaFbROkRj_rf7Co9OmkStBTOROR_qc8IAwCdldnGKFPkYWfbI06w9d3_OJ2rdrMZoU2jNIfIYlv2xFpvkT6hHzJ5xKhJRmlz8cmv9g05jSOJxFVNxzEpi3Hk4JnJRJpG8gUriGw12UFM2CU547vuCXS_f9gzHDlpu2g1Q3nOLu6TFn002PmYUgm4LwusaiQL_O9NMLGS-HTllUbzUvcyXqKceq0kDxXuNdcR_4FFvik3IYugJxviMD2RM_My-QMsHxttOkpiktnB_zq95eF6Uf6xclMFQX9qUMAdWIOJlWxETVlrQuBRXTznTVsn0mgLj68Y5t5QscT9UcpbRE-XtwyQlmnI7ytuiFFCJ_Ldx3Ax8jXnY26BYR1N3KrBYH6q5lQRwhi3e2GJ0rxYI_fw3UCjRPpSsfDb2qcZWYoRsu0HcLL924HpxEohNIQjGt2K-qyKbzo_76TgRBvJfi66I_ifnxljRfX7ElFWZaV8pt5Zz24D_uB6Z0D3byvtRFKWTXJ

                                                                                                                                                                                                                                                C:\Users\user\Desktop\BJZFPPWAPT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969201479279332
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WyI/jCYeqJ6BWBS081Igjr2v0+Mfo9zh9RU3rqSv9NTjN/6YtpAqCgi/ZhryZo:QeYpqWpW/2v09foz9Qr9B56YtpAIi/Zz
                                                                                                                                                                                                                                                MD5:BB8CC3F3D31B4D5964F347B614E537D0
                                                                                                                                                                                                                                                SHA1:426D081A94208305D8150D304741CD63FCDCB546
                                                                                                                                                                                                                                                SHA-256:E804AFA476F86F6650A15879E21984C27F8B4AC3E4C02A8325632038225FBBD1
                                                                                                                                                                                                                                                SHA-512:F51A3D74CBB6D6A84C6C4BC61D3C74919A6BC6227D0E4E8E65EAF0A0C95D3A6F4526F22099650200DB1BB5E87C44DF2BCFEF384A1880C50649407AEDBF7A220B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EULxRp5MAjZ55dabS9pZVaez9zhZrbdykY2lLocQMzMyR3aouKG3M_YIXZBe70zaiASgE1ee4Uqd4wqWQeChGX0KMG4vGSlln7V79Br9ftfHTC7TmRk9Nn1K56rrpO3nWQPFZIx-CvKB1qvHSzbbNkiMOVodDclOrIZvBZ_nuKqMYD3y9y-aCPaJGradTdsBVGrGfnj8fKZ36kp4fFU76yzCU2liMyXwzYsyH02Um2sgp6XGT_QIYLOlP1TyledCVkZbS80FUi86rAhmOUrlPL6r2fbeu_mNnHesYy2OV2nap9UK6u7Ok-ZQIXf5Ik5IXb6G6h-D6_-xeuQ6cJKGad5tcNtlrbFlZ4pnPYa9tvgifZZtH3a8DroYEbVEHsFmnglr3LqSw4GKSg3NKMFbvnNVe0i2_OmOOyR12SF_cg6v1oE0oKeFUJiCl5doiZtNV3qvCUQUAkD7UQl_QPKx-eWFmN144qVXY7GU1FBnFhjGPWxk1AVy-0wwgH7ltNSanxLE3oTORFvEl4Ch54D5jFIRXABfWgt1A9K8Eo7b4I7B7Lqhl8SVNJZMAyKPUSD6yfL1-SNu9SLcb6Y0tKJ4fZ2zbKAu2ufNbPps1F6ins-SLDPDJoirsbuPO351kHzJj6VoB7ttOF_VieEe9FaCwNs-EGRViQgb42WJ8YlXGWbpKObGwLJvrJdMwxjj7DuySyBY7ytQpua7rnwMR13TNnfnkMqnX7TYQjas1bm9o8iJqX4Ml3rEL6epIJcFoiolZE7h1Tu96QMWoy7r54hjMZjyArYl5OvpgL4TG4Yf27FGrI80rbJXbPdhhVlwoIkLMCSgDi-WRORmxaZlSgMs9udMnIJq7MxYHu2na2KBppHq6-tEUyA-QJB4zNL3xCmCJ5u9OkE1ZOZNwqqqEAJmTiFcWkUHihv-dh77ekToLhgoLDkHjqs2W_G_ZsOKrkw4yU3oQ4E3q11s-Dqu6svx08SFkI74g

                                                                                                                                                                                                                                                C:\Users\user\Desktop\BNAGMGSPLO.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.966634771971341
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WYHQ2YEXP5RANzcMsFnfNz5iUYy+VgVS2CzQ8OgV9Q20VJ8LnejWBzAGubSJUnuJ:FfP8NsFfNzEUF+6VSlzQCzQRVqL/HfgC
                                                                                                                                                                                                                                                MD5:8F5AF64C58225384A9ACFC5887A3AF65
                                                                                                                                                                                                                                                SHA1:FBE57FC721F2B81387A82187F87B627922008761
                                                                                                                                                                                                                                                SHA-256:4918D0A8A4488FCD5FC33E762D9E191D7308191C0EEF6EFCFB4B8140EB8B995F
                                                                                                                                                                                                                                                SHA-512:6B62EDD73E23FD36C08E05C4E376BDBAC9D15737A11A4B8EF30E41392E3ABA78CC88C1ED5B7CB6700B8AB3D4FDD2C44730AB1F56F93FB6022126A742AFE93CE3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Em1Fd70KGfyVnfKssa5lXAe0r7p6AsduDaFzFFGNX8CxwXPl71jJQZ7V0hI9PYZtrM28G9oVnxApCutCjmiGH_ULEghAHpaoN_T0v-ptetLOOY45MdcMVsCu3c2oLax9hCHJDk0OM-yjdixDVBcFOCZwZmKaGaL5R9nrbgGJUNXnkItVHUxA9DhJHlvBOhxnJ9WbQ2kC-ZFrb8s_H_dPKDK1H2RhXsW_P-KCbJTJnu6W9E29IZ6uvhdHmjMRUpmARcAHrJGnJenHoPn4BQJxaJlj1OnGerHvYIKra8oj0GnwLtg_zixd_DEP6Q1Lgtb47fQxfuJvKLL3EG9YFN6aZxDxtvmffUhK2xmBJjMWre3KiG2xiPuOFfzB0TDoy9WdZWXpFpkqS36YxcjxEeCtJcmGf6Pb3U5IRoy9XPlxKAMbM1zWzaiixsKU7cRVIl0DnIZnuhIVa-OyPpcgLJguCDhSg9hEwmywYuxG83a7Xy2Cusl3bHSsC_Y1gREAZrJ5hWJX7wCNIUUKuzAMFzmBQ_e0i_yPwGfBPbtP-mgwdVfhMU6cW8fLBYz7LsTyYxJhiPwKGiHGpqcvqvSAWuoaWZ8UPYC599GWWuCTwP066DbKSysveUIgbdfQfy0j2uPdJ53huK8fPdv42frfazZDU7tWRtAL4v6243n_ln5hTAAm_LwVzS_Mun1vqxbQCzedNFwbRuuuFZH_lugiv7lwcd5zz8aSMgWJP-3PreYBReCFTWIs9jU9dzSi1VbD6lhs0754YEvGcN1Lg_MrXTRdKxKVej_pdtgMzln5Q3leXkAdTFjpyNSzWVPSpHuTZWTuWtpA-satcxHuzO7UL09EUfvOr1jUWDv_0QBJxsF4P1ZB6zG9vucHKnkpCjPAfS1CVrzJ0ag8K4_m6jAk-JrqUKRTIIWjxzZ5H8jmqOPvIJW1-VgwrKrIM_PiO7m5zY2jFBwL4o3zvsn1pF22hltyfspjMP71E

                                                                                                                                                                                                                                                C:\Users\user\Desktop\BNAGMGSPLO.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9682172632812875
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WHdyGEgEPXTPyq0cg4YA+K9cO+g4rmRBwEvaYw4uvDBJ3AmhOaNT6pnuRenjO4gq:AvErX710ulBqO+qRWWw4u9Jlh5NOzlgq
                                                                                                                                                                                                                                                MD5:B57E33E64E1941B6DC276C056EEA2087
                                                                                                                                                                                                                                                SHA1:A182950E5C88937AC3A29977B0C291F4E122F62C
                                                                                                                                                                                                                                                SHA-256:20BDAD79F4BE28E267C3177F09A13AB72BC09FC3472E2B0C04CC7475381903EA
                                                                                                                                                                                                                                                SHA-512:858D3BA8720C1EDA1CEE5AD4E9383325C87A901C2AD9BB97D3774D11BF0A5DA7B5110A5A81BECD68ECE713C74765D3F3AD0BEC0EEC591CAFC61B1F03E1664E2F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EYL7cj72u87tb1JafeA6ZNLDXVW6L9sRBP2FtGizbQR9ScNMZerDWJc06Zyj1lVKCs1KJau26rjeV3JnpWC3rvBXBPkWCM7bn-KhvUCmrONlWlWZQBEGqISFdBpUtJMmYzxd8Yf7l1MKxXUGLIfM50ncUvpUxPRrIVkZqs8CCfVqUNUtqvZ4fIF6BhvxDbhvSRL8y8lZ5HrhY7Km5z9Ui0vv_PdW3BqWPlSf9t6Uj5ir-hsNodR6KO12RdzhQrXB9eWPE0Iw3Zzfkm7FFVIPA5PXnkHPozyG5zLJ8cp-9Y2aJfERSBrCgSEJggfg3OI3IIXeZIW4Opr_D9-ipka6YCsOtqxvv_fu1y0nEJ8exzY5r1AtdXntEFaAkOgdRkFZCM58Cbx2ILoP7tnO41sxmVsRCRxu5PS0G5ruqzOCp1OqWyeNfszVupaOfHH2w_uXxW6i-fXeGyOM-g567H9A6fyqDnzNVCjTdaxhERPVbWBKa9xg9oqperZ-fZ0h_g-LQ6A5Olbq9lb6NThi4-9Ggj_Vjy-w0SRSlr7KS1wWmaqSCb7b3DOZ5FKyO2KhVqDdxsJoRlxBffD18aRCZgUqwcx-4j9SMOOsDqqEZ8wx-ul4TioebV8xk_jc90_Tt8DjLCLrbdhtsc1rxOggg_9RAbTX-dHKacNJ_KIUmksPfJ0IO4Y2Zj38vcD90i7zfqaPg4mH61c16VPbjScD0Kl5j2Zt0zB79C4EiqgCFvYHxLXkAZ4muCGsCgC8MrFENZDp4rzSymv39LuSDsYwjHG25_14Lk2YuG0RuZnHRC74NdQjBDkc167qgMynsGvx78CblelrRZxbKq9x8dPAhO9USqkY6vz3HFLc_h9vm3sAcCcZGl6_TKxItbxSxoeseufOHX5PhzdAB85t_mtoZd7ZDB_E9_mWPSykeAhCnF1PXeNo8uI6Yxa8Qa27Ir5zYC4axmTEycu2yyEUX6oKJqiDxrxJphcy-

                                                                                                                                                                                                                                                C:\Users\user\Desktop\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.970241207470223
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WtNFB98aUkUGag1YuCOO89OkNyvVtlg/qF0CSqFwHxDu12D1zm6/v2q+T032n73c:I/hXJO89Ok8vVtlg/GXSXHy2DtDv2q+U
                                                                                                                                                                                                                                                MD5:2F02F97E24A719CEE460D18C9F0AC845
                                                                                                                                                                                                                                                SHA1:8343438B763A9A383A6ECCACCB712AE2179D1922
                                                                                                                                                                                                                                                SHA-256:87A50D12ED8DCB108DEE40A29594A884A22D4AEEEF3F9F3CD000FE784A74DEB2
                                                                                                                                                                                                                                                SHA-512:DCEBF2D99F5D9C596115E2BC35FC6E76727136C1E0E00631B7BFBE013DEB9A35377142E446D4D85773BE40E57FC3E16763339AA33503AD57AE830FBC707F9E02
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EF9ztS6ptHg5X9VMUcLBRaMACFbKOnfY6VCJ91DKCTzsJlMA1FoPYhZDvGu_PRpNObrNpnYbSJirMe8tPGpNjPLd77q2EYeRZZwioffCVLzgM-vPcMezVG3cj7X8LBq2tdbCy-qZHQaH0IoumkXEEQokUFF7AggqnZ-hyZuuk-pU7dMI7T5kmxBqFcKyn-B4rhuKhtPQjWadSFIvobRhH5fKCbwZZBhKmHGxhnBz2pG00IxNUUdwDx-uCfG7Bkhv-BIzajvBBuhafubCveJ_9rYv4BB8bYpe0PKMrpFcTDQUr206CvP-JXUicLawKOgA5WM-rN8l0PUPVwSsGlvym9cHZPboVxvXD-jzXQqQZzEnp3Mikr-SFtFSRwg__UJgEPkeGLx7UB6enIe1ibkmjXL4MAn8z94m2oMVqiQZxUt0_C9dkycGe7EH4BGzmCPD4Sig4PlAjPtE3Z-XD1a40YALHQ1CMfSGvY_fftJFJJQlN3DjhoJ7cfIOWHU6kWMlS2JAfDQlrJtUKK1N83EZ5giAHgw3eauAI5XAneCcNm0yCDbYIw9p5s5tfQBFJwFXRbUnzGnTuHJYTz-iBcIq2tJRAlPN-CbGt_lDmfanIoKPogGgihXyr8tE0Jgc6sPo-96P2mzWhKAATCfwp_e04Z-Thj3ugUUTpNF_S9Z4iDfsUbdTPwbQFDZfet1RiUcOPcmRDUdcj2rkph4dR4OxO5Nhl4l4rYKskIvAMBrK-uce9Cv7qs9WWIOtPTX_14r1K4jpuZMVysVSf9RMALwGliHlveGUDx90gGpNJF_fpITDUJcXp8zqRiuuCi-0BO1yBowOoesvHlUtfomHmTSQNpb4PbHSslb6Wpwql2Y7jMuiDtHHnGoI4wPhP9Tb7Rx3h2BJPNq95pL3zY9w34SHPM8DW5XmiIolxhuLvFFyPvd-phJiQAwISt-VVoG-tKFE7Tu8u6Ea5xZuTS_4cWzOQKUztnqZu

                                                                                                                                                                                                                                                C:\Users\user\Desktop\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.97744636585034
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WyG8IAvkpRNc710Dia7R/X92xpXQ8/Vm51OI4KPpbFN8gcgO8rn1TZ1ESDg:lG8Vvkpr1ia7xCVm51xPt78gjlTZW
                                                                                                                                                                                                                                                MD5:494FCE2D57256D3CA55F02BF43D7BFF5
                                                                                                                                                                                                                                                SHA1:AD0D5E6C436043FCA3F9130401A468C07C09EB19
                                                                                                                                                                                                                                                SHA-256:EA5BB32F558291B5924DD0BBD2F9DB858DB7710506857BC2D308FD504A1A97C6
                                                                                                                                                                                                                                                SHA-512:2A72A1E5C8DD596AEF5D8F3988397F86C285C52227A7B825A86329A067612A1E81F98A40A90D90288DDB5EEB34D40750C11C3EBFDD3F9AB18B515E8EAB67E7F1
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EYTSU_-cPQv5AbVsJ_BqO9ihH49dWwPNeP1aF-8BcQvrYggAl_l8rYu3zXvsD-IgEY009ArRqQLEN5kAwjVjtqIQ6jKkDcd7UO6_0Fw6zlLZhFS8rwnican6IVVpVe_fChomaU1pFkXTHFpF0KrdeKWg0CPQrSwOLMDVKopOL56IwqhkcY0E-YZzFVCLoC1XSuwmBdD-fHkeHmxDUxNqzcU9Q470hJXVwyxvhGD3fp3fRwiaKFgmfbsb9nCL29peqz4sDreGjVmGg12Cbn7637W7uXkxr6Lc-P2chDqKXQ-ym-t3ufUr9KuVOZbX8CQ0Ox2lR1ief5w8PkMPoRMfmq1hN_OhIJFHMjHI7xtLxPwZxeZctE_B4xJt50kmMm5qLLBVd4nXFvWPqwCVo2uq-mkfyPu4jBCbr6AqoT1tWA8WCkt4RSHLlLfGiT6NrY8bkfh99X7A7Ww2mHtAuxfuHglW9mSxfjtxK4yN5jrcNHFQ2shdx5WgzTiuO79e2jCr52ps6MgGTAdxvFuwENVOXW43jmlxPRLUnpobeW6L-WITKEy4QpyvShF0KX9NMsyAcanQYDN1R9hZvOedcxJaIT1TUq2Er0013ltFMNg--LGGR2ur-TvjalpDP7H2hcryMrkSVWcLmUU1I2DlsA9MLYhe00MhNiI_D9tk0So5MCBHw9md9nbuA8uCcNYY-s2AyUpoNA0M__zrKg_4zOHN4v8lWDhPHJt_uPSl6C1EO2TWxc6cbjM8_DaCZ5etLXb87Nw2yfj6GrbuS2-doURF40cGGLGQLg0gSUHwMs2PxEMDaqDKp8sGWxP4ar_MIWMq-wiUR_QZjdwIBodO6R-lf6bhwBNiHD7bl9QyJr8Sbcdblw-du1PmMtiU8oErjIGDP0T0KqOM-TylHdIGSZfrTSqup7NzUTSYjlGfq_5dCxoDtLqAC1u28YPh5IQ78Rd33uysCQvK7RtLoSZkYdSsh5_ABTIyK

                                                                                                                                                                                                                                                C:\Users\user\Desktop\EFOYFBOLXA.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.978127039001432
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WMiOy8Dhp2SFlZsiSYz1jQdpRy20nx/AxB8GRpk2imBeiU4dNc82A:lRya1lgYxjQTUE8GRGHuNc8p
                                                                                                                                                                                                                                                MD5:5FF7292630C9F1F956605FC061B338FE
                                                                                                                                                                                                                                                SHA1:DB1CE9897C5D23AF97D3987BC47BC4219EDB8383
                                                                                                                                                                                                                                                SHA-256:DF9FF8D0C835B25F8051093378DC3B2E3EA1D39F6F7842E0E5468A07E599C3D6
                                                                                                                                                                                                                                                SHA-512:D46ADFA00FF28155832AC5C3D9040CF80D54C8BC958A056A016F8870CDC37C0C30110F971D4A752E48986DB5196F0B55880344E6AAFDCDD60F8539B2BB7395A0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E8tuwCl12MMGw3U080cZnsZpNNzsxtPVznXjGjCuppF_vP-eAl1JVWagJg9WDqWS-wNg8L2WmTfYRQxHLkWk3yhjBjjarCDbamMbVIhl_yPoAcn6wEXuACwGiOSMzhvC-Z-bOJ32f8AAkU1iOnCt8j_0Wld5A0ztIJsbezjB9xmP_bBTVEICcF8jkPbAH3NQ31Im53dwpLqJ1wrlB-UCcI65l53GJ2EmciVKmaFnthZHJ0mKzIucNU0CF3v8wawAKHUbdDil1s0h8JlBktRpX6Ne4MeZRWLLRQNnmM5Ok2xhK1JfpjvUQe-WABVDmhS8tL4CG-4JR0288h7be3R7OgZR9xdx36ljvmqzX_fXvmRIZWnYM_y7Ztl72t2Qidntq0UHKvgxDIdHUqH4uvI7EoL2K-xLLrX9r0Hc7g5mYt5HRe1aJ3SJKfNfImrYWSp5aozjQiL2QOpho4Ui-SKBRxSwfIGbPxotwaIrOSpl9g8PZ6Y_j1sHU_0Bl-A051TPhSzqeeuWxrtUr6O6qbeua99GgrkSKgee2j6qjd28g_cRRjE8r7A_Mc4TCwJIlq-izYN91FMuXWX_hM7z5bQg5QZLOlxGaSqAyPy3i_TLQLV8KTR-lF-YNAJMNieHMvNnVicfMEqWG7a8pqw0hqKZwTDI9ZRkTlmhC5Se5XhIImFJNjlRKRuR0mq4Ljbb7QuYw4C2-b84xT3dOVe3Tj3KEZn1liG2ubbLm11zAjuNrR8V9fwHm4Wv6Guv-qX8QeEKPkCrs3zmHc9HWFZwIkRB7F6naqE_jFa-3BKsSlXJppNaCOwvCTq3f4VVnPzC8oHr_LEAxkH6phspz5LbQUV9Z-Z-zlfWxiWfc8JvCXa_xVppvqVAdEdnFvN2g0URB0RR63RTEBC_50BRofME9k7_oMdXiVo1BLw5AhpU6cJNeTqkuvDNnbi4kifFlXr9x8MwXTdnoUE1_JapHMd9VFiyRUGO-raWh

                                                                                                                                                                                                                                                C:\Users\user\Desktop\EOWRVPQCCS.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.972432601032516
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Wksg+/0ULErdioj3oRrxTENqns36YgixWftVzA31imM5hAjjPk8MtCiblTUBT:Wt8HiUm1TEgaHdWzkFGDAjreNABT
                                                                                                                                                                                                                                                MD5:3A15B012B29A4F5E660E4D8C4B2409C3
                                                                                                                                                                                                                                                SHA1:4810478E0AD89BF8A9F1C03A24FF9B46AA69AE36
                                                                                                                                                                                                                                                SHA-256:43AC0DD70C977F3AD997FD5D6AE37E68177709956C478DC865A01BBBCD83DC93
                                                                                                                                                                                                                                                SHA-512:5EFA7725C7839BC08107D2E39C67A7781ACEEE54726BBAF715480D7534EF293E5C838D057F2C4C0C2FE31E693BEFC533BACF58CD1AE96BEB222E153D38C7A452
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EGxFStPCatDdmn8riE7YJh4w_MHdEMQ45nfn1knHRlTTgSuqTuouQh5L4k5YBEpdk7ECbnlj_NnSPaOPgwE92cO098ZcReaP7iTKxsZhD0Bz24_NBzoEZxrSsCsV8zjOGcNO6inHMAjD3TG1-2DS2lyNUTu53a2rU4zXvNG8bQSeWzl5ejt4FWBG3D1kXht1IVpjfucikNcMsbWKZi0D3xitz6DgKTMBcqXOhQSo1VqAYfA0X8mo2zHkVxItv5iYpzxP2FwoFMmB8Buu32gwKLrTTpB3D4moNRT6zPdhiTt0vlZ4GZ7vBKQttZSGUfEpSf_eB5Si6bOvUVIC7nhgILh0sa-7G4prwbFReJnJjvGWB_bse4LtBwO4vbLXQcvWL73oKpquhg_5MT_XyIG_0t26JMUScdUsHwVyYiV94Kf9JvipppYZM9zXf36zNAYPTyzQU8qIEPBfQpeEGJh8ZabP-Iz-T_5op3FHn4v_P6bs8J84sheithtSOZz2mA9kNHHDJsMSf7wIHR6J8clz0_atJ2HetmUGzxDW6Bc084VaxUmoiuplbki_4IswwH-6IQfiqF9WUoaN9Wd7Nb6ZpUagg-dDthmbQTeFOhbKdWOklWF5-JmxEiou_GxMUqC6juvSxB9cqJ2JaCjOy_AAmdjfZylZbaedAIlnQJwXGw3rRHvSirVWfzyqHnPdaTnwT2eFSbJ_BPeayVwufz-f_KSZOGpwEZLWSTtBk9iz--3O4cE8SSBkE5mQadvpVREoja5mvB04g-q8-MSBX6yuQj-EpHViX0SAJa763PYZAzGNdPQg7UvIVn_HKF8D1h3M6ysP2-iAOKiYlJWILb9Bn3sOw_KbKip8FuxTPMhEPSmjLeA-OVLWWaPSVAqXmzCmL0GfrbizYLljtgJLue8jG31r_v3N8DL0K5zxqpjIPkV3CJa283XVJAJ7nZ9SeHXjnfKAXjgRMAdwU-vRF8LJxbv2AbChl

                                                                                                                                                                                                                                                C:\Users\user\Desktop\EWZCVGNOWT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969830076883011
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WxqGdPxaqqn72LDPtSk+z3LBylAEYUwsxrXBELHRMhwSZki3h3HYue+txnEDCnWD:yvHa37WS9PBymexr6LWhn7V9tx5clN
                                                                                                                                                                                                                                                MD5:FB5F7360FCD3E28C2D91B48CDA00ECA8
                                                                                                                                                                                                                                                SHA1:7784461D5B72EEDB398F43243776730BD1652ADA
                                                                                                                                                                                                                                                SHA-256:A002D4A2EA6374FF8A9E1EC5F1CF624036B979644D366AE99DF7C87596497F09
                                                                                                                                                                                                                                                SHA-512:4F3EB4DEF4BF4E990920AE015D59BDF3DE381EA9588CC357BF10B954C51D4823CA35CF38D6A579362E105DE4B8CB5B2D09F5EA15D0D163B67E515C7C223CE98E
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EEiYh_3YFMaqYi3OdQ37bFuQspOYvM-wajwyPF3T7pe2mp5GHwXrnH2JRknNURZQb8CfwEQ80upIsm4yZ_2cyPN49vfor7oCQuqN3aoDIXSqvuF5Y7PsP0382JeFgVlk-A9ecHZ3LvTvjukjr8ftkUMnkNArwzhuYB-FZB5pfPrbRP7yawnPLSzbY2e8eoCuvhQwmMjsZhWH0PYP8muJqzL3hyrlcnWc7L2pN1iovv5qo4AnV0SazEne55r_-ebr488xg_5vRDuGBIj_7GWTkuLsVAuzhRPONN-0_EvrG8jMuzWs6hhS9ZcrnGlR4drxtw3IgNEelIk805m0EeFshNXbngg76cqCz0m_hHdqolgupWkSTg2YKFv9Id4aatt0uf5Rq0jc-JScKetV2G8tsDRn1zEYYpTQ1lByzUOQwuppSk5TXxKsiBsV8Hte752ChMO2UpQjdEFTWdxNUy6vSS1ngBN5Txq0rA6VLdl4FC-77gvnWSeaPuMUIj8_R3X8qYVFlvTyhqkjvIoksw6sMKmHqB5QjW_uMVUG-05WYbSeIfw0EHGufn2VPPsk0Vj4FcH2cLULQ6TtQjJA6t3NnYmvAL4GahGXi5xDpAIXr6xNEpgyxrQzssbUem2fYUDHXqPMJDGNN6pu-xk-pxDAlUc8PxRwIVwO0tftBNH7bc_HMS98IeYVqiTWic8HyfWmDsltBawEo1ZhmigsMxjhJdC3PQf_B2R71CCcOo58k0n6jE6wJpoPPu_88jR35JZ4iT-ygyQUamJa599OfwlJ9JhVJ7aaST0vuEN2x-Y_UL-8HsMh_3OjypDU98iqs9Rb9kEt477_6ysdoUBOs3_Yofzu20awBNels9Li3FK5O7152YUGC391rfUVmEheFQkr3n-REPaIL2X8GPloWMeFlCB5e2oVTQfci9tdd298e2cfz5nq-heP3fReY9qVAu-PxtxBGA0SrqRhQWiH4OrExv-R8Y06_

                                                                                                                                                                                                                                                C:\Users\user\Desktop\NVWZAPQSQL.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.973773295291108
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WDRshzDSKosj7UTC1xJIglegi4Yhe00LHbwGmqoBXW3UFm3ml7GWX7aiXwut93:aRshzy9TC1Eg8gi4Yk0XrBv6m5GWLaK
                                                                                                                                                                                                                                                MD5:A9075EE4C758778C556C7F96A3FB4983
                                                                                                                                                                                                                                                SHA1:0EED03FEA397E5992148EF52B2C95ED3A761BD9F
                                                                                                                                                                                                                                                SHA-256:9B1DBBC558F5EE49B9DD7106CD31B6DD5573D0AE0275B2B4FCEA523D1CE94FCA
                                                                                                                                                                                                                                                SHA-512:050DAFA4626B747C3182ADD1F78431F67AED0C794A8698B7EC0111D4B8FC8441C183593BC3D19E4907395F26C7E7F605089B0A46D537F912DB01C77779AA331C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EJ5cDzwFiW_LtiPsvkeWVPtxmI4er0UV08ItkF5-PdT67aTpJeAXrpgL8fpx0X-cvHptCJF-xgZ016Ei0iOc7pH0jvpAtf1AFJ5tjlB5xXvQQsg0uCNLNy91rQSsCotWGX_rrq0A8yI4LGrjosCtiUPN9iOnLL_sdlT0sc5VqcA6AfY8IhRkmJHfVgRK29II0fiLW7EgZezecBa2OQ0QoIqtx4apwZ0SXL5cUWY2n-WY2UQSDGny4xaHddpfhCwubiq0cBhxpW-HxXYBGAXrLNhoreIxbUVvfIab3CNzQ4VoIqv4GyPB3QhYGe1iPrOfIC723182vGovRpj3Ljx8GsdHDlSmPBkU--upbk4YLaOhDCaGag0W0rzYJdq4sevby0IJgDqn98iRxLq0MEeFth17w29f6ZL27FtGEWUeFBIidrATBI_KymHdPQnmj1NnKNL9YU6jKaa0ncCdFYle25NPbeSrYIH3wpBMZNCbKJX-u0Y37tbpTje4tdS_vxdVWyRN3qNAzVZtPM3rEFIK-2wZqzq2g53YBF70pWeBiSThfS0abFhYMHPph2GbkF6Eg9PsiqH2hiwplAh2BPpOYHOhZhfj22LCsEHf_EDfvSBfRs8DZrSxE2fDcE0Ah9_ucJ63hlSKVhrRa4FJYTKrdbo1EIXOTN5UsUZoKdO6eT-zv7b55pSFoyWCEZOjaaLQCjZy38gSMZG6l3ZBA0liytB0Siam-rbpxnk7SCLee4d9RcRU3W-_SMEW-Fj1e5w7cEFfDBv5pPB4UYCq8qEMTNZcbccNkUJYAz48t2qM-LCXlR-F4yTvmNXXhf9-nN2dWx3PZLo1aUMXYPhfopJBRq0XyOU7tzg7SirfzDzdEbeXQmZ3NgRqFmSNJ1EKvZ30lI7hFR-HUKxk3xorsDDU8cX9wvOU-0hq80ytBaVEv85T7Te2YRCts7r8BlARmU3nAu7DcyDtCsnAtQ6SWXeIpYHVTGJ0d

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PIVFAGEAAV.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969765076723048
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WTBXJ9TH9DAS3gzMT95BbVwLQtv79aZe3tIkUaRWJIDJGY1A/XBmv0ISwCt41DmD:0J9rDQoxTbVw8Z9D3tIkUnMJ1WxmCt4i
                                                                                                                                                                                                                                                MD5:6D79E245278A5073D304ACE89F74BDC3
                                                                                                                                                                                                                                                SHA1:7038BD0BC998616A8B8D550AE1544FBCB7447195
                                                                                                                                                                                                                                                SHA-256:010C3A8D441E89685DBC66D924B30083B25CA77511EA2B5599DCFB3E01599D39
                                                                                                                                                                                                                                                SHA-512:F47E10DF32245CF6BCDE2A81C999DEEECE61AAEA7AB6D126F531B10490A8247F2A6984F6B949FD2A7D442387F4D4E11F464D971401DF59670D392EE97FFAB657
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EO_Hst8zDatggYiVrY94z0aKHHixlXmolj-ffJ5j0Cl7n2I7Helaw1Pw07oJ6DlWZgMuV6IVTIc-oK84w8LwIRwgcjdMEJlQ1XAbmuAUQbldIgi3C2WF861tpkenJuejupG24652zK5j2biv8jjdX6SRl3Eh-5Gr4YfnfhUMDlBT5pQhN_GsNGA_1ox9j8WNviz4QBtuaC_gZYKwbTA1lEz8jJOfHqupHv8mzLV8DCZpQ_wH9HqbNI9KOd_ZWR8XLWHTvBhePBuYJMpg5YOLTR-_wnPi0-zgd1KgG_yK19Bd_8o0FDd6vkXb4KigivEze19lHYB2ebnQ9uzMS5bJjp7oNntXW6fxYbziGedWdCEg0pLQfroJxoB9cbBans8jZduA3oPZ-f4nnSh2FK29AFBJVcm0AHCAnihh58zzISNbOk5eZhLJkZtvaLwzS9MT0hfSTPvc5RVkk4DabYFndgtdfwyuQvQhwA_UC_XwZJJOj1pGV0JMnIxOdTMLKgeX6Glzhus5gWG5f7uMRVkOGtg0UXCkVVM2iTdrtZ61uge8jxp6WCwVuoJQP-EtR9Z_b5iZeCbNvMN15YvrqUWgTVjp2dTihE5PhDaRHbHFCPn9-EJaBKecrjrNnXJb9u0fjO-3h5BurknrZd4VBuySmRGJFfpiPbhVDMorR1yYezGS22Sdd8HXUzpn78aOOuw-upJZLYu-m4BPjwzdP16uxjNGbfNb2xiw6lgYAsNSwXY-vs90KqDHGvSCVFZBsvzbas1ii1oOcXMdEIDK49aFF_DNQE3Mf3_LbbcV5641hL9_kBjwMfr25_HHNMhz8EwWsbnXFVAq0MpSPhjY38FZc_r3bXzyNd77yMKkmm_SRWWSCFHSZHULah0wnuCOoUrJFIEAC00BLZZpa9fgNUD8ezXwY2XZYZh5etSIwHUF0M7cq2lAjLGpHDkPJnddrQSrfDBIvHmN734lw3g5RZIF7zWPs7LFY

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969988076134588
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WAqwMNI3VpJ8BXnzXTFuLLHfQ6+1A0GQBclgfnTnudz/f6nvjS5lEgB68NIBKhY:o8vJkXnzDFYL/T6yufnzu8notBpfhY
                                                                                                                                                                                                                                                MD5:77EA1C3A6E486A399A290699A56389B2
                                                                                                                                                                                                                                                SHA1:A44A747320142B559C32E6528B065EFFE737C821
                                                                                                                                                                                                                                                SHA-256:07B6C03BD1C9661C7B1B318C1A690ECF34B8A0AD896FF17DA8E088611BAE869B
                                                                                                                                                                                                                                                SHA-512:4E14182AC39B35180CAAB07240C88AB1761300926D3E7F4A96C5F30C13AF8CADCD2B769FB8B39CA14E1A597F4FD1056BA1A1563583FE3B1D19CF0C66E4768D0C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EuOC_v2LtDcUCH6BOmLw7JMi7SmxMZZ4jlvEeP17jjxy8y-AU32cSXgz871gFMoGWsf-RQvJkX1oBrPeUqRg2qyegmUaeRguVt5mir_885f_18qH6KBgpTfzI-ayPBoXozUVabfutF10S3aUwLp4NsXj0mqhkebe8nXIk3EwgyUDNaVGT49tL3IpAxtSDxqm8ruUqSZLoREj_amNh5im2_RDPHCDYkFzyJCxX2VdvvFFGzN3bgPgEDpqLdRg-bZIbZxAublhu6v_b5Yg80MAMj0eXRIv5udIG7PlEtIz7aEIY38TyGl9WSgjr875PRtZ6h07iJzkGEb8bTVMYpxqiPPTVGdRT_HfnIItNt20fxPeTNwPbOri0f5j518SxTkbKrDjhMuRERg_nrcpr8FG5Hbg6yaD37BO7F4ihgSIT1bE44e3F8eLhmID50l3OEpOLPJ0GsbotkFIxoDalyNFA3cWFcu31n_caVMVG-bayOzvf0S8FiOEMwjV3HrQcHySv3Ngx-fEIcdZX8YsrLDbFA8OiXjZIrKYXlEUQkElYbV5OR3nWhIFT1Kozdt0rj_nE1WPm-r6uQrUu33vge5gHdQVeWC6YbX8NS3BlX7t8yrsXJ4Fx7fy4n5fzNCKnd4vh2sOC9Ff_-68ANsoppTZAR26h3vrLUqM7gFlCelt_-JKpY58CraPzaK56LsqW0izzZWpy5AI_F4Pzp9E7E-9yr7M1g0D4dQwmjN7fnw0tx6ki4-PEfzocaBNSSJNntlL0z6ofxTHbyC0vyAa_jvisNwDwqDQPIYGaZb-YcGmtWeq1nexkJEEavxY-329tXJgsEisM0GkDqcIdOCG5sXlVHFWF-uZSrQ1s-IYsaRkJZ5ZV_7rzhXt7XW8aLr8J87QGxpr6hmFpPEsamS5Skeyvf0et36PD_ssW9dKYOZLZmZ5LTOVIhezA4Zv8wCs62cdJjrmTCxv8Rpq5KG1XJ0DttXmdXToV

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.967721431735216
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W5DCX5Db8oAmJ5RxHDJrr0DmzzTgJk3EtZHImsnfFW4n3u5WSVInqsAyU/fz:n5XXLd98k3EtGmCfFWE30WAn/r
                                                                                                                                                                                                                                                MD5:1105013865815C08B03D6BB3E913E802
                                                                                                                                                                                                                                                SHA1:89B36DBEF0BD127E857FA83924D582C6951BA02F
                                                                                                                                                                                                                                                SHA-256:04565131EB8FEF9DE3D63167411316903F1644E2D238DB24B0803503A76FE876
                                                                                                                                                                                                                                                SHA-512:1E4DE659523C3D375C2251D46EBEEECE19F7938A5290D4423C0BCE3C41F6A7ABA2265ECB8BB9F791777A4C19F9B9B8446EB833FEDFF2948973608D41032A94D4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Ea4qgJGjxx4Sdw7nY_6Cuf0Ib2uGO3Bb69mDeR7UYyc-rY-H0wcxJDcnRq2DuORu34FH8EivgOM63AQIN7xKmduKqeaClyDiXdDyeokcKWcyWQ4rCLHAN6NzqDlRyiQWTu_XU_PBfcbjL_EtSAyw0VdIhd0Litsxq1H79MikDhSpqIYxlIBQWg5HXGJuFYtvhq87QcTByiTsRn4pR8gdbD-wKm7oxOeyp2kBzYBsX60r8o_Ac56pgwQoqOTlhamXAiB3qvdDaS4qMafpuAYFDkIdmHMESDlbOwqwltmsC4K6oQQm1S0_Gz2gwlWMGxO-IMZhHBZIVbqoIl0qTJmviQvcCAsbLTh_6SpMWLR8-uytFe52tSSxTcJiMcLcyk2E9vaWsYATRGm6oTQahBgHae-ErteQgsyaJZxzZfHvWwI8UZEAFRtWf_Un744aU-wYHfAx3pei8ZJlJz87wiwjQs5sWMEqNIljWLn4KWtUYYOU66AFknLNcK73W20dmI65H8020dg_S6OiS396eV8sX8aNQtREde_CxDmAi1mhbmaEKnyrqCtDsBAWhMT5BTB1tLvQEhVcmNDYqXthn57LXf66-ERpMjv-FWml7JByAmwIvEbbd8fApzpjDPve03DkR_HD0s6iC1zixSs5fonA7NB7Af51-KXGg_OonQivYtFb6OqErgvnGZ6M34A3_yCDJJ7UHvC-aT_j9K6ZMqyK8NGHCbajeLEjvh4O7xKLSewhqD9z63SQrYA1AtuRiQYcxZd8a4SO_dE6TDH-xaKJT-mS1DF7OlSyEHLWB8Zc_WJimC6aDLgGvFjfMgj_BsvRwyTr_ks4I-S-r7XhfBPTV71la13sG0obZHyIK-8mmOWb2RtcAdbYKXILgbXusIuA-2HNv1G9seDZUd2V66bAYcqvuIhxRnvh0PmIyxlq7ZgvPGCB-XLvcvIbQhnz33FICh8iPG13Kfsgi3-kk9V-17FgBBwyi

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE\BJZFPPWAPT.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.974177414116409
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WpIgx+MhX/v3+LcdQyMFXWm60/GwlitCZ53rYaT9cePHyoOZ3ZjfjmpwvWJ7kgX2:Cp/kceb9WslCerz9XPS5JZbjBW14X
                                                                                                                                                                                                                                                MD5:1793EFFB3703FB24C79A572DC9E2133D
                                                                                                                                                                                                                                                SHA1:EEF202A75D5A240435044A1B23CF671164E3398C
                                                                                                                                                                                                                                                SHA-256:581B207E11293D60B17702E1BD185ACB90434E3A7C1AC2107814EF884014001C
                                                                                                                                                                                                                                                SHA-512:ACD5DBA0E117A59A8FE2551BE702FEAECACB98D90C0BB84FF7050309C4E3AFB9E1F5A6C16E60FE9AFA1D8B16CC4BBB029733F50B676F5C807D777DC4817043A7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ESK2B7xkej0P1NAMIeweKNOusBCo2UKmbqeh6EWGp1P4UoRO1VHZ0E9GRZwbKqJ1lQcVrpv4ZA_aqxVzntym3sRI5JWzrjPDsdvhMh5jfo5SoYek1kQV0wW0L1r2K_geg-czcGF3cX73vGwPC6Ctj0TLwf61B4TpAw4DipCh2ysuUIMIz3CFyTrzRLp4_OTNuCRFur0Ez9cKTV6lcM7ZwQA6s7hp2XM1n7txx9gYTKbOBTqXwzHK0FaKCrBZb8xHETMLNL4PiV9vzyIHZDP9P9RAyphVIeSgCmLFFhFJ-r4LWQ8sfRpuxuSfAdbzZfbCXjlMKm5GQ0fTNGvhZebEpY6G4UUJxwLJT390GafE5exks8ha8Mh1wpG7nGsg08sy6qBHUbyo5KkAVi9g4gNyF1W6Ko4qqT97JArFoTWsP7dsUQ4KHT1FtrlKsoMXFhN8yIn7B4zoS7F7fvzRO0g5pB6upguanrP8r_0xSIi4U4c6uDIdjQNYZ3b65-k1Rp3bvukJNVVVB2cYMsWvsPYQgCQNQC9iFGrLmVFWKJrkIhPXQ0M7JaHnjdcNLok08XtmSQ3uvOufT6nsJ1ofT39EYPR1ceuCw-R601_zecsyB8cHoA9RbwNC9tP7uH4vOW2MEq-kE7MNUNgtVt7aJ6-CzJGvMstmRmlstiAq2AiWUSxifVK7MPwRM9xFywdOgxNvGBryRldn-81bnxQkS8_V1d_WsQVSf79XVyjNCSRLiQ9E3a9Ekl3K5wKsv2X_0BE2X12c4AnwZ1j70hkjUNmh3ulnlmgZUF2T34PNIZYmEqX-jVL6t-njWLPyt5APyjWySfkfxoNFaQqVZnJEHzVZ_Z-eFs56UboJFUqYrFtoE1mWY7vH9QmVRPxrPsgt1eHvO1Tu_iX4pXK4LYAFS8szhJdSWus8YtwNclWYQDiwDGravx5K3Qd9tviEQEuWqpOYV63uIj3l8fSdCVYlufP8s3sku2Fv2

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9868218089535326
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WUpJ29+iqzy3tsZNipS1pLL7u+AC5wc8qu8qqvh+FT1x+xaCbuUZUQxvHk:Jonqzy3gNiYL/D5wc8Gd5vBb9hvHk
                                                                                                                                                                                                                                                MD5:C0D1F624A1370F0D44E496C392E7B7D1
                                                                                                                                                                                                                                                SHA1:28713CAC1F1871E2C5EF36A080B911AEBCAA326A
                                                                                                                                                                                                                                                SHA-256:3F214870534B04869708EAA262B04A67E276C1EE0D5DADE7BDA06E581F5CFA4E
                                                                                                                                                                                                                                                SHA-512:AF752E848ADF2197A0AE029942F74C4CD64CFFC2518D809DFD133FE9B74074862BDD3A78E7F93DFBFC4D4B3174EE220EBA2C7C1338221E6F4B16E699ED7A417B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EDES1bovPVr_OdeayoJqvxuw4q1JA_wTf2dRFlQrHj190ROIlfdsgbkko4XlFhwVCgDGh7pWp0COyrQPbh9m4BvXOdjABaY1A1YHitLEjxy7ffAqDK35pWOD2HsLszqSp6zhQ4LS9rWnqEnUQxCPg7aLz0_shZfJwball-j1aU7p6dw6YlQfWjyIovLuwzRSwXCtdNiRM9W39FrbuxDU_bcsHPaZvj3U-ustxnmLj45e3-iE1HeHxIsY26xrv65ZX3VBVrZUNPK1MJfwCPIFqKW5abkR1tbpnkVcmNUGJZS5F6Mz0r4s-M-othaXMU--PqnrEvRlrlHxKaBzME9mDaidU6sR3jajXp8l0IisOJRnouoRKehsT6tb-kwLwT5RTIJXpQ8GHKEQhqvCvTmO02JkJkgJ7nICe9yZ9TlsU-CSfF91rWOpsB0lEu_waaHNMOYLkjZdkAA2giJIc9Tizn5VFzjjLY4BKroOPYlcWCHrBnl4YpUfXj-qERYnL62SQXJ6as4APDaayUGuTEZpy0f9Cp8AA2VkY1GdA6ChlTciR0zpLb7OzCrLp-yY2MoL1t9WwvyQk7XOg0hXOUKcgqtvNDsRTG-rBCOh87cUaTQU3YOnPVwbyJ9d3neODJWGTbikveRjTFE63jAtqIldCLRz81aHEmlZAfk7HGUa9nNf04ww7o3innA8D-Z54vJh2BYUT116qHYt69-ly9sAil4BmSc8r45UJ2hK0KfUDagM7DoUyPvOQg9VVwi96o0xY_HrqPSW1LQ9D8ox8lTGZuL8ujhT1_TP6-vdaFTe9GtFF2HBtIB8Amg8f3CFhFqWWyBueVmHqFlOck1KX8-mWsN0rK0zuWaCqK5I8U_n0Mqcqwk1EGDIqajfGReh3b1wgY7Bc3MXDvbzYDg0xYIJKU-wmF4fQdmayprS52NuXbPKNM6axzpZC7YpkWWWK1ffHCWn2XIRtLxRGlEK0AR2x2YJYhfzI

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE\EOWRVPQCCS.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.964546891726031
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WeNiWTrc8KusK37leh66QbJfizUkt9tK0VTrVmuc4i/uPKmBbQ5nU5+MqOZadXae:hHriu7m66UaJpc4i/CKmEi/qOVQiY
                                                                                                                                                                                                                                                MD5:5BA3BD931823833E9BD2CCDC1259CB9A
                                                                                                                                                                                                                                                SHA1:F57311AB984EAC5E47AB8366412B96F7FD3B286F
                                                                                                                                                                                                                                                SHA-256:7962688CA06716814963ED2EA016354FB1463E7E658DD215EE6E4F55F7D27D00
                                                                                                                                                                                                                                                SHA-512:63F98DE258A2B7BD248B47353FABED664E48C9F25A8FC55EA047367AB9820F8B0EAD32F89F5BC25A1C40D9F3D418735C0C12214C88DAB56B96F0F852A0AEBCC6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ECdTz7UfhXBYjh2Jo5WCllPGLhLaFRgbZQ1zIr8bS4T7ItYeuB5HxATFzI11UpnCGxNGCecsm4JXdto7WLrihp76zJOZVgdTrl2QIvC4nuOP0Qqsf7kfH2N0dSuiZoGNMn1svPDcv-zTXBL6ryYb6OZrdCXFX4PDV8GIiV7WWxLOM3KC9HeMLCFQmSn-9khR_5MgWiMfn9h-yHQ9hhEYWhsjvAtk7X8GyhmSM4kFF1vYhJPZVqsNQOheJ-5g6U0lRMrimgKjDoqxTliRneOZ2j2YoAVsGCWLa9ol1gB4VTIDvXXXnS_UY3eaOPLQ4bT1T91Lj4qkSBKnJpp92_wfzFSOD8sZReh9TZluR_PG73WZGJnrnRG-ZRe61amnXs_nBP9QCQtRtNnesRGI5ZCjczXtClbK7GZS9XMPB5jVWT6ddU9PjlsQypVi3qdSsnmqAGKby06Ss9bTHUSIN0O9Bff64es1ex1_xwiwL7x2e9W4JVVjixWr0QKUcgdxsxWLKJRrRV18BBXj7XDBNVa_fiWWiWqrDEXEk8XrhF8VhaYhUE5HegWE1i2Xu__uUSvDs8Qmg8-9niUfgr4Wkp5bTYkrva_BMUB8N9DE48Ba9l58qwHTGo-iaZEFn7Qp4dM4DHmXODwBWQ_wVPb7p41lnzZA-iY2AOyYMmrCaVASQkyKiH3X7uT16lT31YOmw5fIo_fX8mz9PC5VYMgq5xG2JZlb1gIN3kstSvNLp51layCIYfJSXFiktTfAoPQdTWZyeH0ISYwczVqKdiulKYadFTP4AwiSWXYd0MNmZVXG7S5PKD9SQCAxn5Wn4EGRjDt-mFPNNJEEJHq3hwSG44XdsZ1w0MaMHo9Jv0pJaguqm4p4A93sfoIL1f03QCSbbxtWJWCxWjWA7W3i7579wxuG9TlqzMNsl0gCbrnWoIPK1moA90wIHYISqXpnXzPhyYcW3ctIdDAOulHzJ7Yl5c8Gn0873wTBw

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE\EWZCVGNOWT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9700787328499345
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WQnOtay0z9uZdgsJm0gknzh+LavwWKSIfMzkfxTyER6cLQPUTlF9hrwAqpYrKbSg:Dn3lwL1JN4L1eIfMzyZE3MTphrwAsYra
                                                                                                                                                                                                                                                MD5:CBA1F996FAC30041E0B9D598FAB5D699
                                                                                                                                                                                                                                                SHA1:1B09D5648D584D9F2B963401F6EB05EEA0425E68
                                                                                                                                                                                                                                                SHA-256:2522EB8EEF2897450866CB2F9E5B96AFE4492A4E21FC1E7D3591F6E3DEFB29A5
                                                                                                                                                                                                                                                SHA-512:50E8942B12C0F0A1DEAC2ED0D834D599CE79DDC80D986FB7AC96CC14B1508C50AD026833070B96FCAD3206DB0E581C626BED35A3A9117DE6B842EDA34EE404D5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ExNNd3NUqlvJzBJF_lg2N56_Q7k7OzNbNA_noOfTHxeoWAFHcyHXvZjjfhxIWfKr9s6vJOb1PawpYpHZKROhPeLuxSonK__YXT6whdvrruxOujRjArjNnO6cACfZKcK4caL1PRCI88MZhcbMnv6I6WTosSzUeH-ZN43PTeCrl98bDD2Wj6o8zfH1oXrQY6vyHdgvRUUHD8S0nB-LkzSkzHuqW5vb804v6P1RWkOGL_Lsc1sWf8AhKMNZZ_KvIsm1H7F-lrsVsDnBf4p_gIwSkZY-rO8BkZaUCWsCSJrvrgUx4dCU70avhqKRw5dZcrQ0K9crdDkLWDX0IVxaId32mHejYlQq2xjPVO1XuXbvsJruearVihoai9a9SbmIYAxlxAZN-JqHPkvRPH3pNfu7OAFjZ-lsXac0VRG6Yunrw3zEolX-2iBHu698mIq3y5lHE3sXvAZ32NkjehOE-MO1hD1FY3qVEMN-ly8gWFbEleirxLwVjsW_1CofL2Y1JzhI6mRcsY8Q2KqShyVSriFrbPhi5147D9UKEHGLQKFnwLJLV5aVVcOpxkBsEOSfpZbmuFIy8YsXsYSfAjnPBDEemGPUS9mcuRZ1WO3dFjzQv5sf-a7sq2Izzbd-EiLfRKEABY7yQfgm-D-DsCOTnVvxJHzxOb-OQ75gVsJxib7GGhqhkUnrzklPr0WN387lvS2prjvEfiQLZQmy2WwZlJUy7_OVMWeFmOxbvPc5qJy0rVz3cSrFLgvHzj2IpLCKCIaYQT4p31eldoOZUDc_lWdge6SXjv6N7s6GV5Nk_D5T2KXMgIAPgAE8wxjwVOtpH6Z4ZaaDL8okEg_e1jkOVIhMlBOYXWqC4zLw7m1bpgJjfxB-EYx6zEp8yhcDU-Y1uCXfdSMpEAw4L6B9_l9yJyGEd9I3AqOPEQhx22CXTC4vMd6QRdgpsE-eO8V58PvKX6g1VD9R6-JiczloE5MequE-KC-qSez5C

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE\NVWZAPQSQL.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.96972085517057
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WnC52Bu7zWPNjhiV2t2spGnOH+DNqk9dUqkDOFYLK206LEd2rYByjnXnGi:2B+yPuAFxHCvzFh206Lo2MU3r
                                                                                                                                                                                                                                                MD5:4A08AD8C61AB317FF1EE37985BB5851D
                                                                                                                                                                                                                                                SHA1:B899592A59668FEEDA340AEB726C78E15526A953
                                                                                                                                                                                                                                                SHA-256:989764ABA8FC1E12F51B63AA53BAA6E18BE05C4B1D56B1417BC465C427330905
                                                                                                                                                                                                                                                SHA-512:AD0937FCCE451CB8BF192250A610FD10B4DA06E07C339D26561BBF2167712215AAF9B4299D033F96431D8CB1DE323EBE4B362332174083644C156B2AB14C7B99
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EyB5PQ0tPdptcvyX4hy_xAI0qVr-JgaO2tyJfD55mDQKdh4PW4G5VmQp1pP7-PC_OPay3iZ_wpmDGQXrDQk2gVBfZrHF5DXmIjyI5f23c6SiugcHRnOhgEVa_ZWdNeYIDWdazD2_6Kdyrltc2uWFtd6rNTtbF3InO36Xqag56o8wKTLg4HtC3cauIE8L8bbEAwwi4thQe284zze0xg82epxtop_NV8qcO5YPXzR0reXssDeFg7hUVEmEDk6tOQEt2q3sFYh4n9VeVtBRlksaH7oW5xBesyQDeVfJdpxElyPP8p3Rwfl0n5cWQjamx1hbUYlnhN3eLKOfk9VTIqH5edtr4r9EhCZBtYHdHJpGzUOViWtBr1xd616-bA-r7mND-LCl3KjrecUaPYHWe3RvftGXKgsInUa4tDRPgwZi2LSsfWu5t0fF6In5FjTiD0NyGtoCARZMYzf0oyPjV9nNhlTHqBuRQv2IuEgZm9AenfmHfn4yo-I_l-V0WHt1Dbt9ei59_a2vgvi6WLmPOcUnM-lJi2R4A6BbReq1U0hScXpiH1VfLxZrcWQzoSzTL2nmspGxxcZ2KBFa-PAkvO3Jtr2oHoZxb6Tln7Zi684l1UWNQ-cmSJMZMEcdrUwi6gyZ07uL80BX_nId9y6-UNLKeZ8unFKq5TLi-CqOhr9svmadcaP0L_aBSgTkmjbdDiG2vU-fOHsYj4je40ewIOc6p0fRL3rO91HvLAguWApTyVVjoQjWZvmuamXYiVKS49E3u-fNXcSlarPZSgmvSVWSBlno7LjxBjwzRiHL3vV9e9EoMTDpYnhJOQVm9NzZ_wawGwBtYQfYel9tJJ9DlAINvreGV1Kv34frcX-DTM-F-jglvwUct2WQPZmCt2w90OIg0im3n10FBbRG5MQMx7XTV13y17GFnTzxdKpR9op_lNQaIB7Mp-ZsPn2MH6yCg1RbfjHHvxDiTThRUWCyI0fenNaKO4dDv

                                                                                                                                                                                                                                                C:\Users\user\Desktop\PWCCAWLGRE\PWCCAWLGRE.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.96895017192995
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WsgSIR/C0u9YadH4HVV9QonAyXK1xv87MyjPXEY08HsmEmkEBi/+YgHWlcTwljFm:RgPR//uSaOHVV6RFTs3rXEY08HFTBJDz
                                                                                                                                                                                                                                                MD5:327B0FB3175782DF9928A6545F5747BB
                                                                                                                                                                                                                                                SHA1:67C7B0014DCE9C95D99D41A36181CC541089E320
                                                                                                                                                                                                                                                SHA-256:6CA4AAEC088BE783A7BCE75874611D692AF49E152303625F482ED32A79A95D75
                                                                                                                                                                                                                                                SHA-512:8BF538BC0AADCC5B2CD5E53FAB6BAA5B8E8FFAB3129EDB7C3076A86845A068507431EDF06D2081A3AB73A77D9124E9D086A8B016F551644D62FF2BC80AF2116E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EALK1f7-kt73UvrFycqPJ9CBuEdrIOC0NnLwk72ZhijFumB0FqPCvDwy6ZJGCJspMXA4leV7L3cm5bXjiXNoHBv1gv3K7P1BeqBe59ve1_CyXVKnx9Ig5bNBXAfV5eWfP9ujGwdd49cqWMVkJzqVFceslSIrcrksfhhoSrU4NZMkSyhvIURH13yI-Xz8jQ74Lve1ltblp6c5SBl-_RUSOITq66xLTPk3laF5KJ1TfgPfNcCux0hsGx-UMDVU0VdzhNCSxbK9zdOIJ_KJ8yKBB1X-I--61U-ke6CvuEfbja47P51F8NDzFAl0OPmCI685VrR7-tT77ExvDzIagA6ZHEEOUKHNzXtBNv1fPlZrDnaLN3GdifiRpdoVh7wYRFOWQFam2ll3NkmSln9t-mbWYeFjHWc8Yb0Zqr5wa_13wucncZsVyqoTmV2yinpGrN55rpyDzBJrYv3DMXyyvRE--b4QVudZQnFzqhCxsR-xBPc4v7gLbdcKy1cXehSLL__83hsbjzvEk2F0BYakVN5BW03vfVzmlSRIHCAP9isqLxRYfq8KCR7f1hEacv4jLC69Ks84jMzfsMvKPALCgcjOqk7Krpe1vZZD5IrkVFsAE3zTqaHqjdyk5QUdT3APOH94oiGkHp38Jg4eK-edFvRibq-vVGQzBG917fLrMMT17f9U2AahNTDwVhFMJI0aAlgxqyRyp_C1MA0eU1ay7moumo7X_WozAjRDCY1FmSbEa2FYh37eyLt1FcWXjjTay6_6KC6SgYvL6ylPR99ORk_FZdL3LAcy5b2hTVDVmlvY-tSe63dyDt0Tj1RLCOqYF3x9J_hLB5jZN8r2rKvjzewAqu_I8gF84fQdK3F8cqLtPU5YjlyV8na21Slxt39DP0W3EFfhBi1bfozGfBTY3E85MdEr_tb4UuAZGdWMR_WZdg48poQe7WHQDTb7P9ppFXk24REB3Yml7wjSzNac2re0K4NUI3ayq

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9743656428315575
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W2okCFc1cwH6lJyHvZwzKR7kNrKU++R4YJcZGa1kGwi0GmpEmQa4HUwubN1/EUa/:LokBcwfvZwWRw8O3akGsGmpNQTHUwALS
                                                                                                                                                                                                                                                MD5:1571C5C7C9DF6827C0C2AA1C82CEF79C
                                                                                                                                                                                                                                                SHA1:E4B80272B10046D92677A68B3CDF55DF8B76CA42
                                                                                                                                                                                                                                                SHA-256:D946063D30C792F7F971F7C05C31F41D1D4E22977DCF690C87EA377C0A34655B
                                                                                                                                                                                                                                                SHA-512:A440016BB04E9FDF1922093985E0F143E1228EDD5F0B3B984E4F08C5B74F3F0399B00D6181D64B7B1681037E1C071F3587F2E6CFD5D062905EF1E49B92DC9359
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ENkO92f6kGiszo-qvsv-Yc1HQ4VwZ2rPZKzc7Du9W2z2S7X1FEHQkkXamt17ICE3jZBKlTLZWIuB_ilcZOW_7dQgjApDiKFqRKqnlCKMMevy3h-6ke9zAj0_Ed9y8avToY3g2562euxr2odXUha2ooKjq9sUsrUQvMnCP7kSi2p0iHBXFSDs-8U_oPwdlLwV3g_ytM0cSs7EMNc-KiS3WwNgV_MDBHlHlMNm8I8L2qC7s_4mVqBr5iZttqEePzwNj4QIMwjTyeMdJkX0n2njPiNN3B6XLCWLZHIeONWbxKEHvTutWVZZUt-fxa6ColBRv-zqV_-rlvY4o-1d9ShMdlk73SkOx6kenxnU5ok-Ra1vs5kfJz6PRpCmzfm4gCv9beQh7v-Om5l-QEx5VaA9fZpHeiP1KuUdgR2zK44eR2yLti3nNFaocHqv_qmQEoyQfIfAm_97_1YQZCa0DeV7VnzSf_azym9DuXX9sXrQH6mha-b47qRmeU_-9zLt4p0gKjIcVLMf-HN7vK6bIY40E0xTsx2wDTx6unLHBJtgZQJr_RcAeaaygt-SoOVdr3UEn69JrUsgdlj6GrTxIT0HCTWi9lWCbPrNvZm5aEeiOKoThIbEI8kMUwNEqI373ld4_2Oudl8b9lz_N1f2jwfK8NTUSHirLsSrB9Jy7H5eWxFSSwh3ArAZnJAe50LNMbPc-w6EwNPXTIfrbdWkn7on-eRx5fSt6wDuQVtiHi8P2c8RAXU16NCeGv8kCEjR5jnf-X5otXow_WVOmGBNx-qKLmbklCPo-Up6GCZSUEl2iUaCpa6nZKGgyf5diMNBjGmzGvtzA87A1QTnqA-GMZnNy__MeLwVt3z-jHVZayso1dSc5kXtFKuXDAOjjBWXiY-jgN4bqFsLRj_ZnD-ASz5hSeNMT0uCKJPnfzfKc3eK9fpUwSjfG-f-KJwkJNlTxV4SzPmeOxcyp721YrK0uEJPqnP5U-ew5

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969447972280799
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WQVSBxm+zb63Gj/SC2TKabIEqn8ucSqd9b3DjckCSLX/uOKDwqDZQveP50:pVyxtb63Q/R2ergSc3DokJyXDDDZQvqG
                                                                                                                                                                                                                                                MD5:3E78BF07734F3B51338304A6DD6785B4
                                                                                                                                                                                                                                                SHA1:393F635D69F5BD7CBAA8730BEFAA35E0B0358FA9
                                                                                                                                                                                                                                                SHA-256:35BC5FABD1A9C1305639D4E81C978DAFE240B64A22CDCCAD8085D3DC1B99AD88
                                                                                                                                                                                                                                                SHA-512:BD7E6FB8D897CF1296578DDF710042AAADCF99D47F0A3427D83A8910BA4C71A98453BF0C802945B4FD2F328C6B59E5467FD1436FB4BB804A2650D25E647B0EF1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E3UpJCWILiwsql5HX-qW4W6NEWee92jmEZJ-zm634M0uBHCR0rEQLFRZac2d0JwWhD26WKRP7FCawL_DgqS0PnTkRnsU7QMvQlPtoQlhd6dA2xc_JJibLORvZzSRzIDbIaAo845sLs1apN3LNOJ0wK82pn9htz1tcLvEeaKRL0GBWSDZGfW2WFhHW2YyT9p_fDZGZUlECr-mlgA-00JYR1OAwdDdKz7ApWjCN1vaIc_2pyK2-soZtSEfHPz929sVOpQwjMAbuV1xxzDFxe35O5l1-g49GHilFh96rt4D0z-V07fM7ogqthQvWZBV71UHt6LnrJuOMGyVDnDrHQei1QyI44TnOzHJ2ztrXwAAukHCLk_w1c8EFXmWrObGAY2IwMJY2IcX3ar1RqQs24bOJWE-pWjX8wbmw7Igc-hNs1FY-LLwNz4DQ78VpScCmx7aYzPiUwL9un2rFLT0L_cT3yDXuAWK6wYn99-dxlbfmPpkUUHi1aeCUdRypxzWDJryt7Z8l_HSQdXfaK8C3EWjBtc4q90WgsNXorV-vqIUiG9HsvujuBjcz-Lkhriygh16KLiyuRE_4uSaISQ2Q9C9RIA4b38Hw-Q9U_lJLiJ7LLoSXg5ce1GGexdm5hW8uwgWqlT_plVrSVLlEvn_oiC1wIDjycV1Wos_qxvprleYjdd2c0DXcd2iCwsyUXT-92OFlhHecQ2g4ddGKqfPOpBIS9uHmkIj4Qfwaiv-9MFtsDShjfSCOMUPWjG6wQPf95dtSBSI4-RGRoqX9vseiHbYe7g3ybJPLWI6b3SLsrlECvYXyRxFZ8voVPLmL-WY8OJIW5U-UuFd1QpntOgasFfEwH3zDjQHavroRq21mniSiXzYU8gwA45UsylI5xeD_u9S36oBN4ix-GCHwVTsj2RAjzFDJHRuXBT4qPlg2RiLkQuQheMN5jb1Xv0tfalyD_WunuGMimBUbovfvMMh2dV9L3WTkStrs

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA\BJZFPPWAPT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.974025200403938
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WhXdLZgFqJ/NRINSCnjahm0yazJ/NU4r+90R71XNb9NII+9+jMX:g397INFjahjRz0a0a7txDHdIX
                                                                                                                                                                                                                                                MD5:6464FFFC448299902A28406E4F49C91E
                                                                                                                                                                                                                                                SHA1:A05F3371D695AC090F519A1F837BBEAD82290541
                                                                                                                                                                                                                                                SHA-256:212D9250515012ACA56FA30A2451E212ACD457C3C4AC2A4221334500B5BADB88
                                                                                                                                                                                                                                                SHA-512:33814C220263A8BEC30CC6F75B2C83A1B88D001E48C13AC96A24B3BE8809D7419AF868386F66B12F52D88948D15BBDE60B214C16777A756366C211D23E8DB7C9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EamFXwPwVP5F_kMb0YuRhYlq4nVnD_KmoyPYy2cOycqqLwsrW59NhekeVeWw3mOIVPBia3vs67VRXN7VEUXVYnhAfyQzCO02GKcu-svTm4rNrQde3AvUMuc6Oh7y0iAomS-M_N_7uFW9EmskP9a-S9wHGUvyfRFCBTpGyOf-zUKd1d7rOgTA5gI7W6uH1JaitdIEvN_H0ZYqhmWP4TKf9-AXkEwPx5TbF3m-n9kTx84e15sPCp5OHyY55dcYFICoMiGWIIpdSC-9sM-vucyTOiz4Qv1C69Ww-xbnyA9t1mRYiOsTH8auF62Oh9xh8_FBC9uODEsckBpOvFSv6EQZJJJIH_eS6mEA__jzJZbhgOT-oTi2bVcUpMKBN9oNMKjuYpHoRVP_fKHcoi6b9TumgP1RWNTTACILOuX9i-1aJBUrsp9o48gB4_U0wpE_VEh4bX06Ubw8hKs3O94RYZKE9ljr5iNRvE6i2g9VqahF5rkkTqSpTKCjpMR-9mgv1VTnZVeaXvFQ6F1N5M6ddVTIoPUd031N2nDHtR00nnU-uaP7XgsuFGZxAzCb_kJOZUdCyzrRH00-ompyZGM_aufK1TbggwiZBDh5wowEhJ3inbl7gLwiZibFnHttas-gWkJP4pWqjY-eFuBrtXaPbZTIrByq-NkHwRRSQ_3-RBxr_G42RkpfpJgRdBlLglbmdNMMkCLnij1stqSPJY8mSHC12TKKW6O2-th7LaLF7vrcSAD6tcWl6U2qv79Wq2SVXROgK-lKKXVgIucnGSm0b5aoNjt1szaTYDb9azjptknaNu8oXiAMB6ct-2hrYWNMykyUcZRKsxiOEJrDSvmUF76bckvNDyV89TcFlGL6-5RV57AJgH5x3ks3CWArzfRe3h1Hz1YbDvhDIdn0vGOv8QvTyevra1m7TKJkpwZ7MLrGyMuouHk6xRSPVyLulwEXDiLjEFYO77F6Q_daOoEeDpCKKjKMdLc-m

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA\BNAGMGSPLO.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9752893781816105
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WX8WZ0qXdOM5I1R7KUe8H+wHQMFJP8GfRwn3hmsgQ7+BVQL3XUXhVD0nI/fg3PYP:gBdj8YP8AMywRkEQD4HiI/f8PGd
                                                                                                                                                                                                                                                MD5:15565042AC7385E8E0DF6096BEB8C25A
                                                                                                                                                                                                                                                SHA1:A23F438E4CFDD89FD8B72B26444ECBED0AC77647
                                                                                                                                                                                                                                                SHA-256:72A20CE514712B790FA0D0445009308740E389D59E3CDF0749F2A4E88D314088
                                                                                                                                                                                                                                                SHA-512:CD4FF8CE08F23F8A552B9737AFC1FBAA7429714BECE6CBB3C7F77011143114D9C59482C5FA150F047C8AFD2046CF0D87F0A25AE2EFFA234E9DA96BACAD3AD4AE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EnJv2r0US7ka1c61TkgI6ikgwAV3F7VHHS4LTuD_MtfyZm_jszBtvQbHGiXZRxpdS2AGNs5vGbm_toWQj-UADc3igeOqq37O-QWKRSgru84D53hoQ_1uVz_zLq2Lcxgv_TJUbyn7z3iobyTi0PpSR3Y5ZiuzO9L2oi1l0O9jHO4CV3xYjJMipGfAku1QOqyr2ghMpcs48dexJ1Nq5tM7FIrJaZmWPZk8_fSWd1DbucivZD6HXC7WnDUyZWL6EdsrOewZjKrmY7_nB4BhO2C1vtHJ2b9vGt8TlQ-XC5yGRxNgvhRb8rhwYc5g_oNxMg_-lniiXOkPX4QUtNWBm0dF3vhba6CMTo3XNGpEWBtiLWuQn01q9aL_A-jBpUGU3g-12qvHzhULsTKwjwyjOHeeljqI2QsPtPRLgEJD7FcCZ0Wm8yHqKNCsJCA9UsQAEL3XPQpgHdTVUKBvFTSbnbUFL-zGk5syocfUFQbnttpHWvJsDWiadi0Zm_l_0POaNXsAS8MeFhQWMW5DCFsbvkdbHj6yPIor7MZI8oDgcIphQ-ZYPIOcxzy33WkUOD9PXY0KqQ0eaNfC_8yRJd7kiS4ylzhZh66JKOONAvMjGkHvR4R-KfMFAMUrsftRJytytXkAN8sxGxdUQKHfsDGJUVhG62E8i6VFars-gulZA8a07ix-g8zgFL0gS7ImxjQalK6XHvCy997V3ORO9bRjfi2-wuTMGauyjvybXRz3y_KSDNl8gBCcVBYXHjCIGxe9S7yDMwm4sqCUZ5tvECkLPT_k6pfe6E5iVzFFTHA3bWLZx5ENhTDSDe2ulJ0JLQQOTjgNXqtU5huiNAMw1LypUSC4aLwB08jWQAhLQDGwiQ2OS-q468i0WwElDGnEkRjK7IGOzgqlY5cI6CAOP5Bky0ctITpQ9qYFxnOPYt-4Hpw_l57cyz3CeQAHc8f3qpW1w4Zpx7rze0zzDkcmlR8QWkG2eUWgXpGoP

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.962368606451827
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Ws1NrWbo1zyFEVsA80Z1M3Pvq54HQ/8zhZ/FtMD1nRZDqBBeKucDXlOq/lkqbZd:37So1zyisF0Z1M/ts8dZ/FfucxV/mqn
                                                                                                                                                                                                                                                MD5:788AB5C7AC6B348DCE81B6AC1702146C
                                                                                                                                                                                                                                                SHA1:A1E85873482F462D3352EB1603C38A11EF9D40F8
                                                                                                                                                                                                                                                SHA-256:1E74BF60D418C0C8D328D6DF05AEF86FB62ED0253FFFFB892196C28E74B07C9F
                                                                                                                                                                                                                                                SHA-512:6C143C1935F6BF53FF0D9639434FFA1D5353C0F0E88B2BEAED9B86E46ADF0C4013C1D9D8A75ED7F1BBDB7E282D7FFBF9B7E718BB6BA66DD5C4F060E42FFB5192
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EaIRQrdMQeeBxfLlrVka33u8wS3HAaewmvSd5B-Rf3r5birJejpVn32EMJq0gtZoVOgO7d5WokbG-XS3EyADbkzax9ZzF02sE6NWTPdfG6BEZ3FfD9wESTgAO1MKDyfAAQFfKCAGeCFs4SnpMh7Lnr5TOLH3fUiBTaoJIEMmubvvazMW2Mx40jtSfWkzfwxq0TwGEulIwtIOrkeiC44eavtBWCoX3WLTuD0cczbKrMaN2oYR2rG09M7hTRZyUSP7P2nfqtx4ch3xl4LyC2zbjVp6-nWitPohK6SqwFSVIn5jXUN760kNF4VCo8iLD-PcvAmEnyY0wG5R0EKIj5rtiJdUtIY4EDaKSEL_-vEwEJZEfqbw-PB8xxchJUQwQYpsjjlhJrzE30fjZ0iYprvEz0_5YiJ-hD3swjI7TOHG3xgq2Z5ZsRZAd_HZbYneTFaozFtCJpmofb8ObZCbA7XprCShgTlGvfDr9zujsB42HSrv0YZNz3ebAlrtAPlwTcoE3KD7ieOxfnd3Jf8CNQxsPjqKF8wTDoRt6MhR3g1rCHwGwSum2bdFBXUw4vOhwX7FDm1t-bK4Z6q3rB6SMY1h3O8UY9Tf4ZfzoTAjwR0B4PYmpbIhBD-XOCnZRSNs4SC4O5gFsYRm4eWUCuDb6uscSs9NocpCVH8Rie3-wh-Tx3_LOcZHUwhfOaoGc5G3RpZPmHlwvgJDRoUCxqz7cF8fDzNv1CZ8BlDWzOLRA8iqsf6-9m_lqb319EVS1TNrZn2fLg6TtNACA-GTm7dM-hv6OM_18OtiEPqiA3W7tsfpvW9B9FfOeuYNANCiDq5DKqLTH_BhNVivUUhxqZZfsE3hAtle-YjcT7UZxEj2GCFb60P8pSLF-1h__XFAuVfhhjCr4zFr7cSIqnQC-DdKBQecoYZuLxyyKa6Kf-C2uJRZXftPmVdDQfmZ5x2LQ7ThXHpsD5Vxs9BuMjUJhPG9QsPiS9hqAragw

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA\EFOYFBOLXA.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.977385460216422
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W1AGgF5xSnyEISSftS1FNNG5JYtm34JMfM6RT2Bc9dlSqBG85Z04G20TFe/Fk:EAGg9SnES91FNIJYE3anAT2B3qYW0JFj
                                                                                                                                                                                                                                                MD5:F3019DC1AA56E5792DDDAEBE601E0C9E
                                                                                                                                                                                                                                                SHA1:B1452EA45F574827556BF82A68919F4556D16EBE
                                                                                                                                                                                                                                                SHA-256:4EFFD0CB56BF7D681890A88C8B5E1550F5643286806B6A78AA1F555E47BD0743
                                                                                                                                                                                                                                                SHA-512:69C559240B475FAB14F7FE2035CDEAEEA84BC26A7E4A09A051FAD92470E411249F3C7C20B788C74D633332DBE2934E6B3B85B56B5CE6BB4369ED32BCE91891F3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ElCJ0TNx-MziTpTcBokK8GEBzxVnNpudtuBof5IqPrUQzl6X5vKh7Bimi93n24E-oAEyuNHoJniQZVMYGApqKGILRUXfJx5W4wUP4Eu5nPGYcyJ4No_n8QuSiPZkKjjjDlTTE18mR-y_cJk2mNFpRiqiFaZ5ttjj8u-NXwhwE40jk6iD-LZhQqUdpESxDSKdDeWzJ8weU2b5FARPOcnd92ADUcxxyePR95AWlOYY9IkpjssjSUOcrdCi6v8CuzFVrBIZCkD9pVLfMjqNMFKGmaqCIHlv_2mezumRuTcZLHn70N8CYG6o4tQYHZCYVGWTNwbbRUb-dg9wLgLQb01SfSb__9cDPhYfaMxT2FW5ZzYBRW1vkeyhD9Z5_TOg_AGwKJSGcVUSaH5nTvN4wlpdbM3W5co5R_NlIG9gSRIGlQj87aVFY_icioAKf3EhDklMeGxhrxQ61rxXOKkJRhuRp8PQzpXQA0HehbCy1bthEBOVMl4SWCAs9Ny1ICoV8W3pG6DXM1ujU31FZHdpFXdA9tud7O8eqEN4ZVW2QK9wXBjk4tp6CWYv3Cfek9nh_3iFuryDRQERg7y2zKsQGaH774tgNPVvrFSHElgAj7laQOek42gx5PzUEaR3AD9wuptNAMN7WG_QrGvU2VQQeEv5nvMlTwn8mwxhFNmFmhn9R51cnUz9z6N_L8-QjplWz3BsSR78a55l8FDlbyss6_wc7XQpv3rim5UoWDrdWeka5_ZJymfZtCAM90oZFfyBXfNFq109uNxXTw6QRJhIhyjeWGE1CiufEjeHgJrhupeuDNKDFG5xKawehdz8MzkO2SydyEjDTJdkkugDu_2wqN0c_6mFGIL1E4ZPRlvLcGSLN1eFMnAIRl0E6-dU3G4fox4LBzsVyvadxZjKXTvAZwApoQaIc1RjnMc1EorgmbYu8njIjVYqR0G60U9KHr2CbNYHuYZJoe1HNm6uGJ_8xpL37PnAatDY1

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA\QCFWYSKMHA.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.96390092046979
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WJcgTkCdCufQ45BPEffe2ZFW1J05ncJ6Bb2A21gSFC5b+xWxo0FMKcZvYU3h0ixh:tgTkyCuoaPEne2qLicrC0q1C9Zvj3hO8
                                                                                                                                                                                                                                                MD5:A7E962843126FEF9AFCC3466F8F66B0B
                                                                                                                                                                                                                                                SHA1:CBCF26EBB69013B683AFE2DE5B0B9418891615FB
                                                                                                                                                                                                                                                SHA-256:53118A3743BD4DE86ABD43540CBA03C833FC016DF2C65D9DEF223CFA63BD376A
                                                                                                                                                                                                                                                SHA-512:807CF5B96FBD93F45DB9A5D7C5D932420C4801C0BAC17AD3FFE6190443426E33131985B05A91147A894FF1035AE5D6671B4CC81C6271FD1DC78C12C776939A43
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E_uc5PILW6RvatsQs7LzELWRbL81QSIEfUkA7VnnwHxO8cCu5qKXNhNx9WlZ9tpYhpA-F176JYdyHxZpx6xUhpBojqORLQezktI97nF_IdYpsBDxScVn0SUgaTJV3kyeuX65AaxaTYtX4PGUBQNE6nt8WwResou31tdlopdIMCmo0wyU-ZdjSOWJ5xWlJq3mdZqxml91Qt7gO1BRr9LV9TH7tVHzskyR9U6pYiqkRw3cQ8tjZNMA5WnNqdEPlCOntHEOXm3XFDPCdZYo17jOhvMihmmqHoGK1dqUSg-zJkd9Xo35KLeow8mgkTSeC6Sys5iyAMok9fkVrVcOBeJzUvfAMWsNvO91cmDF0Tn_lMkAAXEKG9Gi7XoT41ynxmn1g7Q12ObY6ZQdXzhlfbkA-ai3nhdxXSjGJZmA-VWEhCL57w2QmKuh6qTv_SvcpTxH_9VcSFvId_s0CsoknJtX6NFIVxstpHUUCuPuHmlWvaPfpXB11YLpC2sMZ0H9WNAfQw_Z6cb9XCld7nJqR-gJosnoLb1sP1JS26iXiVEmmO_KjXCqBoQ3D-VhGpFQzlBZb3BSNekPMwFg4N1JI4ngZrw38Gq9-uHkddUxKhd6RW2DU0YJJnFqIbJpLAx-2LmKxOr7IX2fK8kGvoYO0dK5BNDc_48LX1j0KRpyAQizoqogS2d15h38v6BUQWhu8zCzcr5RG7dVRUR9PPmyyrKuNnTfW_OQEeSHRYFPkRF2xu1e6hU1FRATqf2snWLY9TgfX5SASHrArGLccEEulFfLjlmE3_XZQpxUGuB7gECyFsCogBX8RDQRFxIFF5sRr7wBtSVzg4ztboeiI-5LEJv1V4rkXPS5AAm-qf1rE8fpGaLaL3LIFaL2Ex5PHcocitdwYQRoHU1KfV6AZQGtvm1t6OrDRWFyHkyG3jJ2C3aoiphDx7QDITdRdV35vGM4DFXDvr_6rpdBTdRyeFXIxVPB0Kfi6v6e4

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QCFWYSKMHA\SUAVTZKNFL.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.971195955220117
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WdpdIIMrZN0qeQh86WHmh4FPTQgHwQojM2CTH1nwDRaHxVmyjageYjrdULOrIQKz:WIIMrZaqDh8hmh4FP0gHDopsVnYaHxVQ
                                                                                                                                                                                                                                                MD5:36783902F15EACF7CFFEFCFFA4FFFB1E
                                                                                                                                                                                                                                                SHA1:0465349FC403A72B045E8A4CC1ECDC0F21AD4511
                                                                                                                                                                                                                                                SHA-256:F7770F7156D26B71E0F8DF04D6B4468597BA1D8DCAD1D71D9C9114274D1B86A9
                                                                                                                                                                                                                                                SHA-512:996D6FBC69C52A5B217BCFA3E2AA9DD90B37DC90B2CA18E160F51A7911047856F8CEF6C6CB079C3479FCAA47FCE7DBA83E6F63BDA02DBEECE133070DBAE5EC33
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ETGrLOb1l_DYegkzEjdV3lFhrV682rByFMAZ61GWMPri2M5LCOaHMuIk5whcwGTm8drUeP3ItA6OlJUfg2-jOFYfClFDcHh-_gBfPFWe8BOWPl6vngsHEs_-lnb7v0aIz1HZCyFANFKPkkQIQpiNTD8x8lhUk4TekolhdSBPN31cELRRg7lhOl25iJBMZFO9ZmA06Rw6R0phHStMfQtFTmsRtF8Aw5aSMQy-Hl-2ECCm3Ur9bG2e0Yw2DL329_CYr08xAZScKAIilSdIh3MS9ktECbLJqC9nRWtUS_o6IEIeYMZP-uY_LKaA_-yC-VWWDcyQgIAn6GOPgzNtjhbYbWVXjRjKlEgy0fXQbLbdZT2MeLNztjkukM6mK-XDuis57HXcxtwj93q44HggwUh_iWtNa9kioSAF-OD2MN52BGHjmkAnMxuWsExybk9-8HkH6qrP8yxP39QAajARcm37eiYGiNCtpvHbM9FQpmt7cSyvJvTjc59sf5lkd_NGajlUoeaNRi6WNzseoMX4MpAJVOR882pwAI2MdaU4iO-DtKN22ST1v2XECWbsIBRuDa36WGzvpKukaqsVhGQ12iDr4XxAbrMAw6gBkfhRgfFhXcPC5gq-HSfpoiFsfvWUtyvIha5dwiKQsV4wIXI1k_tQ0y4gFT-Xs7Jmfn07Gejifys6kijiOCAuv_HNBjviPVjRqjBBA9reO28dkdxjeWjxaC5ASERfnYfG0pkClZrDiul-bH4WMSc2gBuq4O95Lgj-RMEAQ6qKMjbNOMJWf5T2OQ_zZmrOiY2j6KHJ2MZHWz-pdJNfTK44mqPjJaRLkMgybavb3-81hrQ9hWUs1B5LwzZwCwMgTSvlK6LmaLaUr4troAunz4FhF9xBAXVYDS9hBjIVrm8xw1QI8hAmr-K9mmVxvI6S9e9QtSn1LrdFxc__u1KvMivOG_CFI1ApqXGtx9VN0jj-5kAwjQUuezShr8F6MrL9o

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QNCYCDFIJJ.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9801790803075665
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WP0RdF6O5beYw01DwuHiXaIHgJi5uLlBinTI2fODZHzXiekJFdxlS4r13CJ6cE:aW8O5LD3Cqo6lk8HDhzXibFFS8n
                                                                                                                                                                                                                                                MD5:57106D34B8914F580B87E595BE40BB79
                                                                                                                                                                                                                                                SHA1:1EBC2CDA73CF38D7AE33B622B4AF5D099E4FBB17
                                                                                                                                                                                                                                                SHA-256:BF6C8925C10CCD31A2B543A79ED234DB43558D742746A574AC90EE69F12C4D7F
                                                                                                                                                                                                                                                SHA-512:6124C32E5AAE71BD66EDA77C01ADF15760CBD95117B8DFDA52C696D22BB205AE84EBD26428DE94B3E467267EFAA2D3EDEC8CCEE1BB574F05D323CAE17FA6886C
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EhqlERW-1C-xrYKtgUeZSuDYQ7FIlObwa2o3rwdLVkqiq310QDvp7e7n8GJTkHnkXzc6iPH7mqgvtMiro9NrQwxGNHu9EBKldUlfaXWiP6T6ymB-NS6jSDfhZVko3rpiNuV22UcpBeqVwAo9qnsv2AotS958fbOVBLr1AWm2X-93BdKcIh0mGLjG_PoRoJqA82fyRJBChp2b2kI2URBv2X8P-R9FpvyZHHX9tHBisoVmqeEIm526TSFzoFk9w7rf8y05pwAYjA7M1sHyXuRapHP6hUeImccRFG5Shy_B83glgbJZUqJKwCrtW8-10Y5FRXGRnvc2U_R-VX_wGu_YvAZrTb30hWSq3-ImRQzTXpI5KHyVMLrUU27vCEu060G6pH8b7vD0SexRb9idlIa2aR-HcZbQQeo3M_I1D-HmguGyv_xaS1fQA_0TK6wiMfGowchE4ZNVC7DAXv7Z05DN8IBtPx4rfO6htJoFbhFOLkgVElE4YqGJ8Nf0GAYr5_8uv49IagLC1pEYNzmgLqIJJxxJNkSc30lI7AsAjb81Y5m3MurAGf7WzTPLR7fQ-F4uCKW5bkSl5ER6UHOYHPzfuEgZ6FwNz7_FuCkRpnTr5UX4KGA-0lHF8qhA2rGZcJ3QJcUu021WLW-FVBqiWXc_BjjiDBfh7e0uBjr-W4fKSsVpoGj_p-jbwkL-DzUbsVo5RDL7Zx_m8Qof1aCTdGq9oglvNoWukbHZ9gJQJC5dVPV-nqZW1ViSxLaNYqsQyCmiZE5skOsf-7hQBfQFzIVHY9LRa72efrdRxAOwNWmSCksN8bvkP8EcxBCo1tVbaaK127ETT7wym7G87Vz6SKJLm_LjC3l0LOWMNgTHN6MlntxDNnrKlmFw7F-kLOeSqqUyOMk8Kgie7-fSZKMI-eSM52ZzWPcGicTzmZC__eUmU8Cbv0d2ZvNyqySs0U5ezYUmO3iTXIJQ4Q4QK5DBAfLnUPYnIt8q-

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QNCYCDFIJJ\BNAGMGSPLO.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.973841824139095
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W7t8/TYxqjxUK5mAdfmG/gQa+p7Shy0UFzmeaakpw6Qk7vy/zwha2m2Ao:F/TtUKkQ5a+pGDefkpOouAaA
                                                                                                                                                                                                                                                MD5:39A4410F4655A0550F46811DFDB88FCA
                                                                                                                                                                                                                                                SHA1:EAB6EBDFDB64F132F87140BA7429F551AE514D84
                                                                                                                                                                                                                                                SHA-256:8E17EF7F73CF15BCAF434A93865E72C01808C7EE6DB2F541962FB28D1FD1DCDE
                                                                                                                                                                                                                                                SHA-512:3778C7D7B64F3127868E2870255E3E66F400EBCE569A3026076A38975098B743BD332FBF774BACF43A6A88F8795A7FDC9888B5FE8132C16F81BABD2112965DB7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EdbTwImqndHugPzf13HtPcyZX59GY0kqEC3sqyBxePNljFB-J1e97_JVXo5tMkpYU7xqJclo4m7M_dN_xl6MK6RgnLJQMB-VtqwfCIaS2zw8fwUyP6D-tbCs-pfNlG5Fy0HuikKD343hLZNFFHPZrEb9Y68UklOyrX0YbS3tYhPRFsn3l9tS6DjYuRcQMS7gbpAcnYHDaKtzZsqrAixDwkLy_zTajsMzA2XxiY56rDP9eYye7VNu9qqABqhVFgw_AVf1FYi9l20seyr-H0FJsdN0KlKp3-3Vs8mK1oPbWi06C0a7oRjDSVh1lQwaJjMreX7RovDd0Nb-28aSJPN-Ezq3tn6zNwz6Mul7zvGxv_YZhknNJvwJfStiumfd27ecXXgO12qZwhf20enG9Qql-LetFVL4iNfBlCx4UN5waPtFBSJf2KtB0GXRlGTtdUTO_Ka5FZk2vRsO7iWoZ-m7oMUgcn41ZmOB17UbYWVvrWCyA4Ja6aajea4qUJamoNWwyG7zWhDruPr4D3aeudRouNDNjrSo8V5NyXopehEfBLIsJuyFyvGbt0jBoI4jtxu2ho8R1Vhl999bv4Ba6-j-egDV5FMc6T83AY8TbP1ok9OmwWjPPMlLfUEz6YaIqkTGQ8mcgWLlCVdG29AKJPus_j8CceJlEMqLVFjbS2-fB7ZCt0DAGf2Nh2F9egoH4kQdTBxZ5GCeAMzgQ69BoL72G6Xoy1E5M3vz5Q2IgelsGwd3r2jM2hus2XCvNJADmctO_MWS0IrRGs-TvMLehJmBK-1JyQAEotwNpEKTL9q2QSvxbsJ0IK2m_Vo8FK8jJR6TaDBig7HlmadHGZmUY49IU-_ANP3YJWob9ZpCXe8JcNIibb6yAnAameWLyFJUJyIF9JbxZyhzXcoE0dB1WIFKKDgr7ASniUFMCPJWQmgz5ZxIl-CoSSmOzdLOzZ7ZBZf-M6ueXiz_b9nD5qQIq2YcmrGrfxv06

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QNCYCDFIJJ\PIVFAGEAAV.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.970551384742574
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WIRds6CyAR/t5beMFwhGoPY3/rVe+7M5Gx5FY7z2a3UDbiX+BOCbMKT6P7eGy/qy:VRds6pCt5BiPwxV7MEx5S+tb5Z4KT6jK
                                                                                                                                                                                                                                                MD5:891B12B6A1EA793A243730332B817017
                                                                                                                                                                                                                                                SHA1:F87BD58CF8BD250B28C788A20DF61EFBC271D954
                                                                                                                                                                                                                                                SHA-256:EDB34C102892E9DC8AE867C355BB9736CB5885AA7BBA5C37C4827E4E5E12187E
                                                                                                                                                                                                                                                SHA-512:0B17AB0915150A04572AB496AF3AF263264EB328A7187D6E8845386CF327321F6050AFC0FE175B91510C2527E3C6C41DA1BAAEB448828D6B85C775335E4AF1F9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E4puLjW8BmuszczQ6LoU68e7e3boLn9J9oySK7BTXH_AWUCoGHdoy9fmzZM4sSWQNpJmJbZC5Ej4pipYQIHvGXj2RbP_iAAgsbsNZDYkl5mb1l-4XYyWxiOsXbm2cvAE7Lgp-Y_9gZR4Msbffkv3uLy-m4fzJ5SJHVAwM8RdLwf5UkhqIGv_34gwh3LuRHgfpec3hkrUvwERAnklFb-JVP2yrBsmLvd0qnkty5sgfvmbVdCKdKUnAZLJo1f63eIUmUB-GVwbZ3gv3ZezzttLuZh5k8Gly2tU8kO7KiU3pJRmQPbaecXgdyV2h8NEQvfsJlc1BwRUHwy14n0XPK-o1oxh5vDQS2Lr6q0c2wooRmgB3GGcF9kqcF0MujZ032PxDUvq6CwuBvwWYQWMysQ4sl0It1Eyvy8PCQRQ96aut5pVBRlf_THPyhjZUCKj-XB1AoQDWoB0JBbzt6KYlUGoDNgfNLPM2s_GPYL0D4JSB8JiCeExQLK-gY8ndoHlZL6wWxU9la9BSu0H842CgwrRwlqIvQSUdi0_lMY1gmHK-4vsYf6YF95Rzs_udcl69tX85VmKiR2yTASdPzUigWzIVu8txxdoX7LCHwZfyu6j6NHy9Kmdx1WJKUkNVmn5M4u_F2loKqk4cWswRjRX7lCXP04en7LUWypl50d9vVPdSNw2XNZ30mWmktIrshjF4MixKJr-1iIJYXAt1kvUV5EpSYof7HQcRU7euBw8BjhriCg8hCqrrp5PcayttPQCkoGQCtopoeaOzXfzQKLkanUAY7-b1nEMxwXrcDTSZbywslwlCmJHhnW4yyNC7RJjNoauh3F7rZtKzu23_hs_uN1d2k8EonvsVBp58akC93MRY8TwxT-GjPIAkhxjmB1FKz4IH3cLtP3INKUNAJIXwS0jVcMEcY-tSJJPQIRR2uAwYNG_GXhtK33gDliMxmrOCzOQnulmbBxY5fSM3vTHLd2AN3QXjI8Z2

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QNCYCDFIJJ\PWCCAWLGRE.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.978212943877902
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W/cjyR6ZBovvUOhP+zTioa8V8GN1+12Kq0NwTgdp8dugufEy5mAFfRemSvPCu6+D:VcfvUOl+zBa8DN1+1e0NXpNgmkgfRYvB
                                                                                                                                                                                                                                                MD5:6CAF5E586B82E4A3071E7CB8859ADB91
                                                                                                                                                                                                                                                SHA1:C894511194707D770AFD4A19802899498B76A372
                                                                                                                                                                                                                                                SHA-256:EE35C964C82BCC588C9164642D4617393E4BC25430698A46E3438F88E39C42FC
                                                                                                                                                                                                                                                SHA-512:8D63579A3290BDB07F8242334287F953D47B1273501FADDCB21ECEBB2222FF728044AF52791EA136C0E5AAC271BD1E5936053986CE7F275371EE7072D08F6562
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EanejuwUcq_61BdXQq8_iEncH5j0APrMmrw06AsUbobydWmEZUwJp6RjJJ9u7MbRcbhWYVRH6vGTlF_H9jIh_HryfpPWYWIyjmDBWdX-5DnYDXXTbruesN6MtLGolpyhWlKDe2v5zAt1Re_HMQrZOnBDyEAZz5-XKqng8E0zfYmzcFWU59RVFVAlSZPnlAhFylpD4dP9NIteGpjE0Eewisuzjxtn-U0ttFCyYI5QcYbP35cFJST4lpnHkzIFcgG4c9XIENMSu5SDMhRaUXjJmECGw7YRhSywtbjjo9iNvxcm8BDJfdoyPLHl0Mhx7iRsbHikEFNhSYANIjvrGm6ANUBPRZOgCq24XtwVmd17FzIHB7oHj171mnyQ_My5RLQqYYW_Q0Aehf0132KJ3qMdluJo8o0A1vvXEvS5IXJbHOqoj370xw-IJgVmUKgEtH8AHwC7quRWfyHoF0PLhTFp15zhxbLs1XzGuzRW79xQxylDZYO5J4WIX_utJvv-jMwaE5q9AYuJ6Mg_yLYQBLMpw5_lWFx_rGpdCSQyqdDGpHd1SFvXvOuVP7zuLF_bZ6ChG0AaEQ8Boi-l4FIxnfoSCyMVRrIDtkc8KsxQgSQRLcA4NBM-_SNl14TxMESZDH7vAKhSfCUt9blBHdzqPJL87CHZW6ezuG6Smipp1DWeg0aWcWQGTJYB3JI2bVVpOjThW91CiT-CcQY_eptVm3sLuMBVIXiwMFt69uoLh8hf-lS7oIYhP5dwd1NM51Z0Rqzp_38zIjRku1fkIQW8W0NiMTxLMTSsRY5IwoQfkUZ4f5iXTOqVMidmu2_Xn5klbZDEGy-AbUUjvj4pgapul5FvJ63DjOBk76vBRfKk5cRNSwihUoMoW896VQGovSrpdaEx3UISNTJLqnRQd8vM1B6O8IbDC9plpJ2A67aST8NbDwdNcJCfxf-OhkOgO2aAp_Gz1Wno78y8KZSqHogKwZTIYPRAigZh9

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QNCYCDFIJJ\QCFWYSKMHA.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.964322371922127
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WYDpBS0qdpDeF/MiRxE32HN9B+zIXhQVojp+wnQLNBMyOUxmzoCYnhxLg1CIUX9z:FDp5qKFcCvBbXh+amJaybCoCYh9g1az
                                                                                                                                                                                                                                                MD5:17D12021A9715CDEC1A414D9DF0354A7
                                                                                                                                                                                                                                                SHA1:6EEF2D705637C6FFA599AC0C10D293D840501864
                                                                                                                                                                                                                                                SHA-256:EABDEBAE30A4390981A361DF57F602A350D4DDAA09D29F4A3F50C2666B70CB46
                                                                                                                                                                                                                                                SHA-512:9BF7E7EEF2E7BAABD57265ABB5E6F62ECE465CF04396C28291599B9FC73A2850FF0448269295D07A668F3B95AD66AD344F606DDFF3500F917A5339AB8C53667B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EmlmRaUDA0pZ75jZ1y9PtOnH5FYDwbEpdRXwmA6A4AGf0-8jfPFHxqHiPw9WVxzPAQfuFUOnIn2WF7F9bbZ5v3Pb-Hd9WdgrVw4TswY7VJa3mM1SJgZTbLNr6qPa2LgTNe3xqK_c8_oz_Qy9Vy9BioQfUdazQuWyFT9HaJKjSwem9T5pEpIguZUrGS0TesOtAV7GcTrTai0fWvgHb9kboJZMlUMQKLP8F_MSuSxLVrM5W2m0N0Hpsc2u30WynR7vXqJp5h9n6s92x4EUZWffFor2aGjLaAkpoEC1vVUXtSc0cb48uOi7uDrc0K4zz_Wd_zYDhtGe63s5HJZq6S0tIgokfhPoCfp_IoTa_xtHT6VdqxLEoFCE_bYV2tMk2diMbwiqSgBxGDyfVpl6jAOu9zUVP16wJYvgdn65Adq5BWQViDu-rByjW1nT6QKvRPY3tH95fiiGsqHwiaoRSALT5tH8Rfqiaz2EzxiRb8jVHou7ZOOO2KRCCxEtAyo6swVA481_bqMmyW0npjSbEOcoMO_RLcWkwRdddaVPy8DOlFCR1F0RUaLBpFPjgjH_6aVs2dNavbdbiEqY90dk9n2PBDYWBa1LgX5crbk0kX5VXtgTjYn8Jr2gRm1TsV1X-_AoGVksAnrmhnhec_CCYsB0AHW7bvBnhpr11lKucot2nDDqZJBk1EGFuFaFwMaR_-wJn5oBpRF7HIYUilDFloBm5RY5RhLia58iUA7F_ARBTT_mKSm_WdANyRvRcMTjZ7S8hDAWeON6wjEsG52P8NbTw437dKjmWdRepgmZ5b0aUMyUIYHooTpuJB4WrWb5DLKa5_AuTM0aFTLuFXwdg61QICm6qfATLxc7EiwRHUTG_1Jv0hwp3DBbyiMNTD0U8uu7iRLLyEa62CzFScL7tojhHuAkUwY-z0Mwl7orRdyeoQyeMzUW_xJ-Zx_6wvdWVT1cCg8V4DatcogsJdrVtE-p53BazxOiT

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.974838065382998
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WMclXJW9whMiVUm8whGI6TXgutNaXjk20bYKDwW6gH2ScrgOV:xaE9w1GFwhGBTXYXjP0b9wW6gWScEOV
                                                                                                                                                                                                                                                MD5:BF5A08790E73670C54021022E8D65943
                                                                                                                                                                                                                                                SHA1:640C47ECED7DD99C3F16BAE8732DA5DCF4B41D96
                                                                                                                                                                                                                                                SHA-256:052FF00899960F2B6B1853DB0C183EA2B0D02FA0E2CA611B9E7801782D76B0BF
                                                                                                                                                                                                                                                SHA-512:7F1C49D07940452C4C802C96C026F105BA685AA57948D2AD850099E3CC15F592658A34E791346DABD5EB0F75982B190824063DCE5AE873F3C4DFF47E663360DF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ElcJv0pMythUhTSpHV54OeVaBpWHFfMjdYhStjiOXR0lfbnb6sV7Ey3y8BiQgHUAVYV9PHS5WG5eYSuCqNLs_JBbHHhRWBSY0TIH2XDDYyxN8QccCct7xjYCOdE7qWVyAyV1Yd2aU1Ai02IhsqFy4wyS0GXQvSVoIQ02FerobjVul4UuSEQMZclMAwLJlq8jNDhyZz7Wz9_q9fPAd5uCCWF5vKQiDrhjWVDN0qnU1Oq9EP814NDqF5UTsBn3W6ehLlJcYAaPmlhUqg6-m984GBXLrFj1tcdzuXR49R1GyL47ckL5Y4n-VDNSNVTIIAm6_dQ7yMI5UEtojAinGr1Crq0At-qpYK7MGbFB7zjZj7SdYtF8sF6YUb_AL_Lr1qvWb252qNhX-tIMpWSmw7FVf1UhZdh5QcS2EpfxjxCAPKlRo3pAZCRUzkD0Ku-bgHBOC6UfyFOogYKBLdkQBBz1xrgob1iodGcbx9AcSoVVUY5wgFb2-ixkfMJ5SvasvefQrGpiCXsQJMQIKrfLegd1rqeHL_uYkSbZqtvad6h3nOzrKKO8gyGG1qXIFa290YaK-aOgHFQBjViYgxbvKRq5GmGo3qvD2FjB7ftZUVJj_qZBjtaqSnfcW5tv7BFsITakNuktnhQ8y7MirloDO8QCg6oQNZ7dzPzpxrXX0sM9aarQiiq0gGTRlqTKN7FdFX8aNtN8tGFMOlebb-Cd1DvhhkuRTNr0cmOsUxQkoxdzAzPlRy6RQYk0ZbPKT4FTJQJjFBR59W8HQGiQ54tLWj7jeQZpn4pVCrObXnVK0PdNkmfa_sQmSTUqnbUIecgoqK-7gP7nZgwwWwmfWtCe2HVeK8XpZCofY8V68_BljWksMQuKOXmKpzAE3Bp2XY242GxnS7e_B4neNYE5Vx7Y0145pgwXUY5rzaR_ERzkDOyW2leykHsIN1uFHAj1XS4sp4MY_zUM7sjYaZ-U9RWQruzQ42FnYFwqv

                                                                                                                                                                                                                                                C:\Users\user\Desktop\QNCYCDFIJJ\SUAVTZKNFL.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9766779756342086
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WYQ6VvL2GS9VtFCE+JH/hzlzypBsCppZoC/RUKC/yN7mOs0/5MSCWX3hMBaXfY:FQ6MGSbCEgHzyzpZoC/yKYamOLB+WXPA
                                                                                                                                                                                                                                                MD5:99E924D404F7AE81594302BB2226250E
                                                                                                                                                                                                                                                SHA1:EEC247C59AD22E905A38EBFA21417ED355613A60
                                                                                                                                                                                                                                                SHA-256:17994A18A1D1C91BFDEE7D7FD90501904EFC6395A0C4DC2794B72C8EDAC5A9C1
                                                                                                                                                                                                                                                SHA-512:2E7B5FB201F44499BC9C6E01D782575A773D065B87269CE7ACBEC83A0D1EF612B77DD484294053F88E7ADE8E04D7974CAA7828F0450A8644E91B9D10BF7602ED
                                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E-ZRCyXdgAA0F05ozyw_O-kFBGoOsM3CagiUAN0msIOBa23t1m_fQQCfHwCrW_e7MDMkuxrVKa77bDGPnlS4J_RkUmgO1vPVDGWEhvGJ2vN5yYkJQo6BaySe-EwIuRS227aDDzMVHW_ar6XnYUm0DbOCsGn4ZiDG5McSEHoK5uk79O8deo63OP3wofh2gwbS17BqfvsgkRqrnQxSxSVXT35Zcwgvj16We2qVrZgmjdIS63mil95ukNTZEPu1JzGHL605fKNy7JDdA6DRbdv5yuoYB7gMR7hsJMUTEPnClomcPbW2EgUtNq2lLj4tC11YobNBAVgmQfL9-UaHR7DlsdS5CWkTv2an8ndvbuuvso16vMfW4bPZu-VKfrW1jKGhnHSiQzUnT-HW3tlcS9H9V3PSxDMlM2ZSbf9_UwOBjhlSPSMMxE8cnROUkVtooHbD6ClY8fzutYci0nPMbbGmhQ4Sd6mDwJXdWLQ11L1ZUaIHA4KctxkjUUOnJzp4GVrABwADr24UCC-Wp-RIXVkTqDrG_SR_8MOOf2sfmCFKSBdYXFgN5Asnqs5pasdDsGlC_vBSFOEZrxvzasgBqmF0PgkzeEDZ1KkHsE7rBWrIZsq8U2sFajg04KHKIARI-PHfStaGurN2DMp0LNjULlsQeHkp7NjLeN4RztnFbAKxhVM8IOsMX9tSXIsaNoftPBUBe_iRRalEv_i3VUvfQkLqXnoHYyOP9b3XyMq08qJy2bOcqVe6ULriivQii4vnUA-5aQbaovh2TSWpETGkRO1gsgwMR18PZ3TGdfVygiiePmlA-RfeINcfWWhubhwQset31gIbn5dco4zAwSqLP0Y-oyzQKzXVFeBM-yVhbcOHVHGCcVq77OSYUf1gN0Hat1d5niuTIwVDzAxw_Ngs9MfKMz6qxiXy9kCGQbx5zPDIGJuHmgNkYRX8oS-Pu1StWwybSLb3rIjUIbgmgSsJWxqqoQKRT9T8W

                                                                                                                                                                                                                                                C:\Users\user\Desktop\SUAVTZKNFL.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.967363116929877
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WmaM7l/Yf3faUHUwz350VUY0QIZjX6+Pe3KZqWOpjyMlrif1a5Jwac2iHrTDhN9:0eWn0w750VjHIZT6AuKZGpjyom8kjr9
                                                                                                                                                                                                                                                MD5:DE772CD4D316C83293AE8CFBEE8D2B2F
                                                                                                                                                                                                                                                SHA1:708F2A336C13611540C6F371A58BC0B377C99D3B
                                                                                                                                                                                                                                                SHA-256:CC165F731FE77E3592BDE603021ADB056CE73F28C8809F5473475A4FFC6229DF
                                                                                                                                                                                                                                                SHA-512:48E81A5DFBC0925B4B7596C0A315DEF7EB727E6ADC1769803A51F20420CF8D7815C7E63E3BAD7E80A325357F181FE073EF68E24EE623FF0C4399A790866000C0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E9R8LYsMO2cxniK18rqE8FjXRwfSqXpdPYJKHezRkqgp9gUtiQlbiaoWHIFzVmsqFYhL1PcPSULFT5nTOCKFAC49zRjuTbImGaOSksXYi9q-RzF109pIOLxISUicsxsEp4ywJKbyhhQwDYYDHlfv7aVNpZ5NCC2RcMFeJFRxVRhGVgoPbU8ghVbIA2ADAUK3I1CtmR_dqk88uG8bAuiWyDC9k0SOYab77fSu0cDrdFps4P64iF0r1zm5Dc2SGLnHoxpzpCBcAZjBgafWjWoAT2KxNwyXZcDM7C-m9a3jjsnlb6N1KZOBQFFH7Yc6KNn13Elwibhl1uSiAaFcQDopaHXrn3aLtZFE_js09bYR05RgCT0p8RGemglor9IQZT7-9IDuIvAvT3wF0w5NFEbN3EHF4iMSxiuuZCy6s8NpcMXi84uBpHCmP24QUHjNh4OrN4XFhmvlkj5ErozXYdq1jpElA4mEyksXPgrsww3ZVsD4D7JweZUFYRXgMur-rG3SEv3NX0i3GZaLaJBM-O2gdm3kAv7mCcsY-bSgePMQ0XhYhUmR-EIyWs47cNPMugf0aPClMh1G9gxMQkT6GrjkQBVXCnLLMUuF6DdHcB1x1KmBrBgtj2CpQIFfz9ZTfrQ-efvzX8jvtpbyUrn1fiXGryChj8Mod3UKmOibztag0IpP_yz4LZXnKsWW93mc458OVYzKRznK4eznFoFaYFIKWq2pTL336ooJ8l7LgN1FiTMsoXbv1jhsqcCvZb2gss7hTnGV-14xZwn20IhARxKHvrWPhembLiDrZxrE7Z4OdzAWlxcGif2g-tBgagbdORZjR6w1EXDFprgc7BXKfAewIA_IK9DrHsRgzwiNOyaj1rAcEUamc5cKncJmZJslCaNeJP4tArnMhCBZNr99okI0vZSyil4R92YlWgK1ZXCznAssOch8MGB25_LAjkNON9m_ykCxOOfvn-I7HEVqeKX4dt_JzcO_E

                                                                                                                                                                                                                                                C:\Users\user\Desktop\SUAVTZKNFL.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.972144365435371
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Wlsghh5N+0apmgvGKHYcC139tzkI4M3DHJDb5YhnjgHC2A2rnCloyxUfeWWQmM3+:usghh5b6lvT4VJ9VdtVYkHK2UoheWWQo
                                                                                                                                                                                                                                                MD5:19B867DF131C406C0CAB9E930812E7DC
                                                                                                                                                                                                                                                SHA1:FCB4B71E25232B7499C1F00EA5DC7CADD6C83E55
                                                                                                                                                                                                                                                SHA-256:FDC343216DA3071562DA09630C730239DE03728602FEA00880725099B0509A18
                                                                                                                                                                                                                                                SHA-512:2980EFA6A5F3DCA4ADBAE3A07D55C5A4588806679E2F036F502734C614E3F7182599CD6CC4539BD8C88A8CA1FBB6F8188145036FABFA2A7973ACDB6E285F3F49
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ECSaNNCb5Dnf4PMAuFu-aLfWxQ29tBfZnwdrP1qIeSX5UOTgqNhzcKBB79floYqbx6LQLjZEUqYEXjHiox18R_DmGkkhyTtbX81IMFSEBGcENHjPleVfgW1UQHg_5tPtzfG3dJpiqbPakRMcxEXrKMF3elQn9s4rhtylVSWWEYjkyfpVXRYmsuBjev0Db90qA_vjLK4JFtj7E006yVvDzEa-Lzxoh55yJDxZ7yhqS3ieamT3dCO9m859HoecxbthVXYHiVxf9LNnUtoNI_gP-E-PtBbV-kMvEdWYWkfrY6L5xiH6Ptx1tfMTdLWmaXV0k9MqpJMsW8MMh0P-_UNgXvdn7-T1BKhM5jvMJjXHW9MYcstH8uobuSAdmpvbJ9pToUtYEqPvFjKYXr2e-erIR_KZJaxrmzL8Hp3X1KJoPztyRKlpzmz39hkkd8YFCqdMLpwPxrnt4O3TPilREHU4MVLSMtvT2Kjpyc87fteo7gBmo9D0vbxJgmeC4CJKhYPCb0wT4CP-HnMtxyZnkUJ1jH9-e35i0R6Hc9nH20njAyAQjLp4Qo8BwoO-lp8B6msW_vm1fEp7NjoDyLNa5bYTILUqdCaCVtVUs3c2W0ATJWBpEGmKeqVyHEaBWZANnQjXaXc1IkKqTgBnlnlyTXuxLIFRYTWqVQQ38iqbtx9jFbQNkjd6awslsx8yA2i875f1C4BqK3IG_bJ8eTbNqI0oBA71vmhF9aU_F3AiH-4yK6h2jrDywbncWUZhkNquvTb-mQsPv2XXjiL1Xm5Eo6RQ6bRCLtVAzUVB2qGTeFPXgmJV0g2FVvyYFhtJxW3WH14Cfslm_e4PfZ2dkXRMC1Inoah1qphohLCFV1F9tW19vm1rSup-yTEiK2FM9cEnguqK1hGIP4CV_-IYTSU4nfsC3WPGASHrAgRclPHN9CD1ZFBWunmA76crWzaQ4wUV8jn87AvTi5aW6TpqoUj6Y8sY7FcVrVojw

                                                                                                                                                                                                                                                C:\Users\user\Desktop\deadline.json

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                                                                Entropy (8bit):4.243158791671846
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:YBAVLAH1lrfVcR4n:YDLVcR4n
                                                                                                                                                                                                                                                MD5:DF0671DE1FBBF89E33B88D3A14FCB9AD
                                                                                                                                                                                                                                                SHA1:1F4C7B9E89C8E8021DAF912D5FF56E64CD0FBA22
                                                                                                                                                                                                                                                SHA-256:D83FC8ACD327863A7F160DE611BFAD3F93FE72BF4ADAE63C916C79D9336EF6E5
                                                                                                                                                                                                                                                SHA-512:0BB326EB5F7C487078FE924D6899B8D7C532975CA3FB37DB31AC43B4193FF0B10A37F416892998C95DC458F4AF2501E8E2108B5B98A6D1112DC9DA15811999B8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:{"deadline": "2024-12-01T08:39:34.192604"}

                                                                                                                                                                                                                                                C:\Users\user\Desktop\encrypted_files.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4674
                                                                                                                                                                                                                                                Entropy (8bit):5.070908029780962
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:96:ojo22ZoxZToIEjJECpoWxz4irR6MBFN/8QoXBg:ojgiyz3H
                                                                                                                                                                                                                                                MD5:A2461C8ED17E9CBF9D23CF7F859B4D9B
                                                                                                                                                                                                                                                SHA1:3E6AC37870C46DEA52289ECF085393271D2DCB14
                                                                                                                                                                                                                                                SHA-256:8F212DBE4A3ED42ED85AF82A601A746B9FA1B803C189D453B228F80638AD840F
                                                                                                                                                                                                                                                SHA-512:F628F5503B0761133F752CAA864C31114B03A999903EBA8FC4F7EA35332A4E19FA81EF14425922A5A97A2153FFC145A983019A624CA533EF1F3CC846616E52F9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:C:\Users\user\..\user\Documents\BJZFPPWAPT.jpg..C:\Users\user\..\user\Documents\BJZFPPWAPT.mp3..C:\Users\user\..\user\Documents\BNAGMGSPLO.mp3..C:\Users\user\..\user\Documents\BNAGMGSPLO.pdf..C:\Users\user\..\user\Documents\BNAGMGSPLO.xlsx..C:\Users\user\..\user\Documents\EEGWXUHVUG.jpg..C:\Users\user\..\user\Documents\EFOYFBOLXA.png..C:\Users\user\..\user\Documents\EOWRVPQCCS.png..C:\Users\user\..\user\Documents\EWZCVGNOWT.mp3..C:\Users\user\..\user\Documents\NVWZAPQSQL.pdf..C:\Users\user\..\user\Documents\PIVFAGEAAV.png..C:\Users\user\..\user\Documents\PWCCAWLGRE.docx..C:\Users\user\..\user\Documents\PWCCAWLGRE.pdf..C:\Users\user\..\user\Documents\QCFWYSKMHA.docx..C:\Users\user\..\user\Documents\QCFWYSKMHA.xlsx..C:\Users\user\..\user\Documents\QNCYCDFIJJ.docx..C:\Users\user\..\user\Documents\SUAVTZKNFL.jpg..C:\Users\user\..\user\Documents\SUAVTZKNFL.xlsx..C:\Users\user\..\user\Documents\PWCCAWLGRE\BJZFPPWAPT.jpg..C:\Users\user\..\user\Documents\PWCCAWLGRE\BNAGMGSPLO.xlsx..C:\Users\br

                                                                                                                                                                                                                                                C:\Users\user\Desktop\fennec_key.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):44
                                                                                                                                                                                                                                                Entropy (8bit):4.92511855035714
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:EcLSVR2/r4V:E6qsr4V
                                                                                                                                                                                                                                                MD5:7E73888D22AB0726B1F7D99786A42354
                                                                                                                                                                                                                                                SHA1:EEC56FD1B94D5D82329DD937751A6899E1C3C8A4
                                                                                                                                                                                                                                                SHA-256:DC902A82E94529E0ECAE87B5B073726D44D5BBBB60687C33FBD9E7C33C116AE3
                                                                                                                                                                                                                                                SHA-512:12E1617479065D6193DDBA17BCF64B3CC2FB9D5AF2120235E474D1591AC31A36C111684BB5AC9C04B9113F6A6A0767288FD96C3134196E762D08265F97239996
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:54N-nfnyTDKG_n54ok76IX5SZ7FFLaOPW2lDsuUAIWs=

                                                                                                                                                                                                                                                C:\Users\user\Desktop\ips.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):21
                                                                                                                                                                                                                                                Entropy (8bit):3.0589840894454268
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Bd/U:Q
                                                                                                                                                                                                                                                MD5:F1AFA59B04E1026EDE77E7E19F35A38F
                                                                                                                                                                                                                                                SHA1:D3241AD506C846F940E26A14FB52042EC3F95E0F
                                                                                                                                                                                                                                                SHA-256:4C7209946BB4436ABEB4F0B3FDFDEF077B12598DD0F7D22384B6CBADEC5331C7
                                                                                                                                                                                                                                                SHA-512:7D2764FF30670DEE95D635BB51E72168669873C7A18F2A98FCAB8B6B784A777AC231588362572CEC0E4509EB274DD4E3F4843B6B1B114A0006D454B221E0ACD5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Public IP: 00000000..

                                                                                                                                                                                                                                                C:\Users\user\Documents\BJZFPPWAPT.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.973670882803589
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W9HD0KDTNqj2v7DbI1sutvH/iKBsvYR04yYlNmjievaF1jGEWuFbvx92wjD1WqXW:4DZy27I1s0iMs60ormjB8Mjwjssa2k
                                                                                                                                                                                                                                                MD5:582C0322D5E30A9A8926F14C5DFEC062
                                                                                                                                                                                                                                                SHA1:C5E9391724F1D511ACC8DF8D30C1CCF3571A2423
                                                                                                                                                                                                                                                SHA-256:997472E9D8FE4A3DEDA0B0EF9AB07B2B132C8EFDF52CAAAD93D6A13FC912B782
                                                                                                                                                                                                                                                SHA-512:7D6285C935C2686EC04213C601378E392F9EB47C9C96AD8980A1D6AED1AAC1A05E7880DBF0FB172D5C94A6B1E13C6C91388653BFFE90E207D3379310C7B24A31
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EOkWwXyMiA1yHdRDZFPQqiikOavfM_yn58TvoNZ4UtwAEj8OrpCuSE0o7JuZQVNQfnb0W5iT2oMM9TUWlV_iY4wiPBWYrX8oUxWB6Fxrf_ccY_XBjD-JvxN-7nVJX98sbnah2QSUKbswtT0bf2jyvXKAmqf4gnGx1xVSfLydlssUSQhzwTfWr10cUdt5lWRfpKXhfGtaak08HYWX0D8embx082NbDybMymbZFh7tykEzYKVwFHq5ae2Xl2A7vQmI3CE9NiPkPVjfADHF-8Kae5C0opdoAqblOmRZxpwHH74bBQFySRhjpvwvemnxNS68A1ADHhg5nKgLR719GUH5omZWFuVZP22ZubXVt2dbOtaQTLEC4Snabv80xFeH_lxWe0pizSh8aWEOaT-PtrA8fqqk33FIZ9uo35AjTpukmNY6M4P2NGsI_Ofj6ZSRxuoBBd1kOfVNmwmhw-iXFhZc_8374nIIXabVvfQETZ0-9BOYTN62ngZNvcZtdRdv7698RrmRwp7lHGs6KD_AtoXAYGgnGWmnolq5TvPz66L2kSj71RjhGifd4HcfOS0wN917q7MNCSYY8tK84_EX47MfUdLBlNnyRyUlFz1BLd7Xudkjc3amnTkQLhCUaHL_vcX711XVoRM6rD3lKMsmDc7lmcaNz0upEcsv1tX7p62LXTdoFTTP-m27ysh9nnSYXJkUl4_e8jJic7ZKN2Xsn3xlb0gXJhLKfqRdd0xPKLMrKZkIvG_Qlx8yHYMkyiwhcQfti975SjebWwUMUk88qYLdZzx3XiN81cDDXLIHZ-Y2mNNNrYZd5TjVrssUuY7ezCzU7cc5MBsfRFcQAJYnTHaUBFCWpCfae6__qqF0yEpTGSpdDytnuG2O7XuIzmT1U7QCJYrypqSl0XMsaaXmxWQ36oJpCFquvNbfia_0gixNjdkHgncdUE3OC46S7MXVBWlOrNswX7Gi0pkmx2R9CeHAlDtLFfWjh

                                                                                                                                                                                                                                                C:\Users\user\Documents\BJZFPPWAPT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.972004264184997
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WK2lXVxxK42xpAkhIXXl6Ira45C4IDl098NuUYEzY3QS3zGDGWu6urvdCwGEJitg:/2JGB2nl6TFR09uNzYPc6zdCwGEotsOi
                                                                                                                                                                                                                                                MD5:4FD1AE5F8B0A44B3FA4807718964A57A
                                                                                                                                                                                                                                                SHA1:AC5B225C25E3042DB630919F61AEB0EC9AD41688
                                                                                                                                                                                                                                                SHA-256:82A23383E20FC8DEF6758969065F0FB8BD54FE08FF696317FDE73BBB16B33071
                                                                                                                                                                                                                                                SHA-512:4C9ECBCB1ADF4C0483457DCD9DDF54303AE7FF436CC4817CE20AB6859858AAE3BCC8CF8550B3ED24B5E27EFD9352F3358BC951472C8E2A7DB7400C33B27D25C8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ER6gNqocbQ7g5jQleJhCI_A8oUP_5j0tQCUqRI4d2i0ADfvFQTjKRibIURq93VW_nTRu4dKhx4Lpx8dYwbfA-78huPUVNvcRaFzok5YRNiMIx361-_Ugty-NkyAmds066f4sISx51a_Fp54pd1P4CQwpv5I7siXlwU_imwwDVaLWNMZcsNe6pEbE-xS67grr8JKnmfDe_SFIkop14nb-GAhXrfOFMCheo_-yy0pt_pFCMxg7a6NEw4mN9GV4r19oyPj1AubbcKREH4FbzHMBOiFxbc_XSv_D4CiOQk8pIhm6-euvpvvcYvAonKVmxriAEqbPgdFpjAknHSo_VlCQKdlEAjwiRM-ITTHnLYakmiUBAijurofxxaoZjAK9C9EZ48WwlCKfmZdP8kLj_ZngyqM2mnMODzop7pUhGyGfTctR88eXYaam4XM5U_DGol5iTg_3wU2zIjsQpAnBfdMel2SLAF29K1_8tLuUUYVEhjy1gt8ipXZLducipuUXt6YK4yyrOZiLyjqWx6eeIkiLamY1Sqc8nOmEiwmCHPgiiwjWtb_Y9oFbDwJWefPqTGPG0lHnVx7itHrfyK5xx5sujFgUPY5gwPkIf5bf-39BCd8AhA-N9vWChA_n8B_iw74b9xNgImTM7i74cUeMz7pInrb3bRiyNwb66f8h87RMueXYtlHH4zwLv_r5kGM0dVWW_E6CJeKnbnJrmjs5A2r_eLVLbV5TU_oK8kEQpx1Ml8mAFh_0q0IcNmS1bzvQMN2pieZ6CIYR8MtYDFnQZVrA0m8PxEEBW6c6IMbFTm4AEJiuOeG7RbAcd9vFqyzMJmSnulPfNe2OKA5jhIv9rbhIjM6_lSe-BQG_bsDU-ok7DqVhPiP-cI051zyb1YG9NPAN8YNcDwAqT-Jt4DqYz9XrkR9ct3ahtHy7Pv7ot8s3EsfygqMqzHMMJ6rdLdrpF6W6JdCULN8zecxSH3iBraNnj8BIO8z2Y

                                                                                                                                                                                                                                                C:\Users\user\Documents\BNAGMGSPLO.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.973202044096461
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WqgFbgsGNa0q21UQlFavkTt+RXloLmFF7pLUgy4K1S22yee80aksT/e/Qp4ttXwr:Bgn0q2CQDTGWmFNIOyr8h3XctAr
                                                                                                                                                                                                                                                MD5:6183584ED421B7D87F5918A9550CD739
                                                                                                                                                                                                                                                SHA1:E25CE1FB2206D5E4A045C1B74DC3ED504ADC1F5E
                                                                                                                                                                                                                                                SHA-256:338ED1937AB6047C8FFA408533FBE0DC548F58AE8AECBBE5A15AE2E9CC7E5726
                                                                                                                                                                                                                                                SHA-512:9191E368F9CA928A99DE6227FA98926F3988F057135923615F9A9932C66986D0E6CA237E0DC14ED3F43A266DFE948C02F1178F25AFF961A8410C8AAF33C7ACAD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EgHuNZ37Mxp5f1RjTsaMUVEqRJMh3_rSKAh3scA789s1PfDH3s1OQPT5xAx9G4z0YzfWU19L1YSU5trwkoGe4NIBu0Gn94d1FOee3MbWXqyXCJzwcB0hS5-5ZsowuAf3XeetZe7-32YpGJAQ746b53bmUUpy4fLJ9UuinBrYc0RhIHLOmM0YjlOk47rMiRKdOFb8mpDg5m2fPB_Lr9TIcppwogSy1De9hCXJIUjt7NXrzQ20E6mFxQ2npf23IngVNNMujYbxLmxlXmhxzdvcgvzgaqzI8ZM-VODW1-RBc_cJKx4N0Yfvt0duMp5vFhW0KX5-p4FPmI7NWOOYj_uctMKS4cwyj-DGYhbVilN5DkSbvcdRnhjl4J1DlFqvVE2dMIv3g2sSXvg9H5a294oMesGAdpJvzQZCq8gBOrnRLLARkULldsO_N9-U6bQbz4mwZpc74p18-MWjQwL-Iu37aN68GmztKOnUyM--nTT6CZr1v0fyB0p7ypadRpe_g6D3KUP2SGTNlunXrVfXM3B_v1xvQvhUXJ_YjTVVonn7gdWx4t_2gZdRGAL94C8p27_EEHhRHECYz5sG4wPA1O77Z9ftpvU9v2fD3-zjWMCLAqhiMmiWgU6kjvD7WiQ_Nx3Slx0h8JKOJvRVGIyR8__2gEbWPViibs70OWE87uo-scmbL669fYc5OlsPXjf3fvZlQoSOnfilFkhkbsWO82Un4qTHe42SpB-hHso1_5yqmOWQRcq62zE7SImzrG6scQKV4UPu89zjmFjThqxoEp8J258xAIef1DedMHa_3CesswktBv3qvLsn7is6e_cfshUfwXPTUV1KWi8IDKHYl7r3NdQ5FLX-WVFzwo0SGULDJ8GM3YQrTSGhz6zynmZ0SyYWYHYodTn9XoICWEr_S6OnLyZ4o1FTjehBpLRJp1edNmdOMUbdxMI7EUVfJAG-WHOB6xNvOdo9KF2KPhqYS0tTSjLo4CdD0

                                                                                                                                                                                                                                                C:\Users\user\Documents\BNAGMGSPLO.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.980237649782513
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WYPy/w1vNYBwq4vdQakJ1wf//as04nWiAGIiSEBGOYyDHTouhe94+g6utIP/vx1j:FPx7Oa1CsTnWiAOSEBaybTJe9A61PXtB
                                                                                                                                                                                                                                                MD5:D7F9DE8B82A39DEB87CD5C46B7FDBD7B
                                                                                                                                                                                                                                                SHA1:B0B805D2B8AAB538E6D3CE156E08BE5E27868B7F
                                                                                                                                                                                                                                                SHA-256:6D5473C0B5142CECACCEE504CA2F6885AB0A6971386CCB95A16DF87E25F0A9FE
                                                                                                                                                                                                                                                SHA-512:646FC239804BAAB646960378EB530DE7D0505839AB4E1D7F8FFA7B64C6D0837BEEE66821ADB008E87119B0C867EFAD0CA1AB91C553676F8E2AAA02E447E9E5D7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E-mO_iy6XvuLsuNxrhMnd5MsFrZHGfigZb1273aiBeEcMCA4hGS-HSXoxpT-M5vkqCXotjCTof7k0N9w6r9qDctA1QfQr0kS0bIeMbHowsrBQJTEFF7uGX5yYa8gXl7pljRePrrtBodeXSsQUlB3F6ETHkBWhjFbMtY9xrik9bjNGcmE1FuxRp-Fc4CxlBPR6VNQXP8KCqHYhWrI0pVXovG2Y48KXv7Cn6B9Ylf3u8xt_Pdn-KD1yPCez921zF8Hk1f8pbqrXFWpjCKsNsWrTrF_GO6zeSjWugG11ZJ2QTUANAU8uM_BGXanrZytrIezT9m1BvzpSAaqWwSW9hOT3Gcs7-FD-LIJbt20uaku37vjfuDG2cAY4c769CYnqGDjgzkarQi5Jz2c_ajKi9JSPKxAvQsnXv_vYhrX9Dbye5E86eqUcexCDUVBKT8GtPH2yGbNlo0-XG8JUh0bvfiVAOcX-K8mVCJ80ou4cA0OIJp_5iDmZ0cYVvZ8cUPuCiuakIf7Duh15Z46ue_ElJgCW8AccJ1HjSBzb9MMdLQf1m8B5_dJ4nC_8eovvjPBUNZzcNa5ITdHHV5gMZCWn6dre3-ynGELofZLzuwhWGdZpXOfd-G2EITORiYwDBjqvCtAXJHCG7biTyAVEsivD_rrWdYoufvkaW_P6M9mbe-SbuyEDkEdPcT2Gg4XlQT9Zbn_jHo-NPo4pj7dTVJ_GL_3fr7JsbmkLYVMKkh7ZaoCFYd0K_4TV8yDli-IcowfhaClh2MuJ-j-3G5qoy8ui95upJBGcx6kXLhCbZ4fmVx3xZpgmi4VbYByVhiW5kz3u4Qhq-sb73nUHpwRpUPHnftvczMr9zKPReYx7KQtcP5Hlt3PqO_33f-yXawLKDQN_OX64Rh8m6Rm5ypkzRgIS16b-pQZVAxN1q5gnOK8wkEczO-CF9b33DioE49bYwQ-h8owZJP6XgOtvqCJwEd_1Y9ypxVh9ZA5Z

                                                                                                                                                                                                                                                C:\Users\user\Documents\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.965904634626959
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WPKaVHrJGb1AmnJneNBwp7ESOXb8s3ovSC5qzg4AS2cVjM3Zk:SKaVtSJeXwp7LEz3ovSWcA13Zk
                                                                                                                                                                                                                                                MD5:CF7AFF7D18B1D08EE2F8FFC0A9614D16
                                                                                                                                                                                                                                                SHA1:C6FEE25C411133E6EDA3B2F2627844E63A0AC048
                                                                                                                                                                                                                                                SHA-256:C94C367CB599485326AEA4D543C76E0A788341448D127E808A13AB061FAC889B
                                                                                                                                                                                                                                                SHA-512:54FAD98692C99F7D9FCF45352414B0ECC2AAE8C821E53C3E4E23F6B7A9881464239ED8CBB8098B434FB2CA540E2340A2A221AC72C84443138D01D0B4F8332021
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ECrO-oP9EglzvAPCFeRLsHkHmv_Q0gCAxW7dYS0zrRm-_X8Th_bVy-nFu5z6AVGwiSk2vdKk6f-LZLCA1Q35NtXeVxHbCdHcqIC1K8RxwEbY99UazL6QFVt6LGmWZ_WwT4VOUModQ0bbqHE2PxnhgiuY_CZKBjIn_YZgHQgVaF62aR9d4q_JZQLrYxhQWpe1_ew0ogP1ZFEoYSoXD_pm-tZP15B7hKz43X3-lBE2CvKHAZqIndfWq5LyNfjPwCEk-WMWEL3PrAx5-zmangDeBhZ0Vx7tlHt8YDGzy1pST2sINrLqm6CHBafENaI2jITNHb7qeJgXjxOtSDQxvyWOHv0h_kQcWSweKZ-sbkDsW3gF1ApcclBciqPLPfQ82h5muFHhPm0p-bmpo541bYNKvntv_TBAKiJ5JNd0pDNQHMeUuUjEMwUxBJRhyMsyrWgYktrOCE7b-TbO4EqH3qVzFFsS6nfsuuoMbXQJ-UTYpdJiH3yNpokstCY7SaLgLFiNIe69LR-7bkaT5n2AH4eM9--IsU-trfPhjCKN8taFTV2HpfkDebOdFJzrXHH3VUYjYOH_WVDGuJ5kEYBqNQ2tVd9GLKIns0wluqqmN9e7LA9JKTaSLArhj1xDHtqTUcEzE_L_RtGW6rg11ez-thfgX_2sJQFMYHn1xqHmNXcZzyIlbkUCK8XNbh7a8taMdczp9hdlBW_y0Z9w86iLKfnG2twa5NvcCXFjyNy1f7R031zohs0qFpbFq1U9rujozfSNytmv1FVun4r2_H4wO1UfTrk0eqDp8hG9Tk3PHOJrNqZ1k5qtZ6Tbi0vsPfels746dgaq-ChzOPwUrNEg5iQJcyKOGFMcF5X5qdOrgiRhHCgeey1KrdyYW0YzmoFRgBV-ZY8XPl10wqvV9ZGWMgjTSqXNHDw0Mzbz2TspLWUxaLA1j-RdqQeEHOcCqK0gAgGsmPs56qRGSt_DYyRU2gBh29Zb6fQwN

                                                                                                                                                                                                                                                C:\Users\user\Documents\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.96936005564724
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WOAOxCewQBsAGf6rKOxiFFgl0WTIc9gDwcpy/t1VFk79FwGcfQV3S6:OcC3QBsPHFeqszKeqaGwQVR
                                                                                                                                                                                                                                                MD5:5A12DD3CB3114A0C010E09556D2EB625
                                                                                                                                                                                                                                                SHA1:D972ABF9FB5C9602E6978AE54ECA140EAE037B38
                                                                                                                                                                                                                                                SHA-256:6C737ADCB985BA0DC94A4806189B6086613F5F60AAC118D354FE883383F71BA8
                                                                                                                                                                                                                                                SHA-512:8127CEC148B861B90F67CE8E5A3C7B5D598C7D65F812CCC792665AB46D051A75DCA1EAFD6625AAAB436BABA053116F2FEAD0757929512C6762EB6E67A510C08C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EDnrgPJvXoFQdogefU1jMbMKaIvtVQMS7e4MUNgIkFZkqrMxB2n7xAZY0oXMhzfKMFUMxF0K8MUs2tAlAbtUlKi9pcL1cGKhI8hE8N6M3AzYyJLifpKkjuLK0YknyFZtgOfSJxrlDg4a20MiB6lyTfBY4QoavsrmQJpOCuTs5npjo9jz3oL7MpaTFdsJz1jwMYzHFL1sbUgxHzOIQKOSdUId7fFFb_rJr569ywM6f0Mn-vhA-ycXZcSusOY1eNwK1FbudgHw7yECf1SxIMhS0XDF5UWAr7f2nsdPuDSINLgtViNLZaKWDXSRZh5V_k8rePDv-1BxVk7IGDv4i5obpRCklw2H4J68wc7qIUjYRaUfjto0VJxItldT87AAY2IpStC1EpAgXLrFjGaU-nV5PgbSpaL1Kv3XBM0oFpBRZEi64tmNYhsrh5WgDUv93sFM5p9cDsrCbU-s_CKreLKY2Fac6PAc_J6T00Dga0mqrhiDSiE4Is3vUTh1s2mThK01avrAGOJMbgs_seqVmL_p5kh4Vmd9St3ozOCWQcepYnQF-madahtbVnQ8IaHatfjSq6OAga69WmIaHRJ1AnUdsT1mADvmnfsg-Jv4QCZlNW77lnOzRETTLPYqC8AlBZF9e4G0NHiQR_6_RiYzLqMtiSDNAHFe8PNBQ4snJbtO2WMtlKvYl98ecBE-Fm9M2GR-H93yebynLTsFxYRmiqlwLmXWfE2WpCDOO-IdiO_2EQ4q4GBk1pLm6cTDROE7nEWyGr2vBGTAhA5fYc3Gu24wbURCTTyM3uxODvOUzOC4xv_3aj2l8HLYjw1XcDXUywUGDc54QMsYLsN9TdyOWCx0zVbIHC2CTIH1yoIkyew8lsBQVoXDOCVhAHa18z60ePYkTTKlPwmpv7Tp_AmHXRlN_ks0Pgb56pqXM_GPuK1rDCyeX_txo2Z_QIIJNerJvmWun-oQIT61AeMc7eJp8ZD6h9cMCw7R9

                                                                                                                                                                                                                                                C:\Users\user\Documents\EFOYFBOLXA.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.967151336703524
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WXpQWExxHWKewsMuWhCAcvlJaNAdmBAJ61MrcKddR8qJZlmPSvW+ETaOcyu:UJExhWKewsMuWhCAOlecw1ucNqu6W+wS
                                                                                                                                                                                                                                                MD5:E6E404A5484A4DB9973341F44155A5C1
                                                                                                                                                                                                                                                SHA1:F6FFAD0E4BBCA42D254117B623A17D8557474424
                                                                                                                                                                                                                                                SHA-256:295500A51F9EC84EFD76A519F3EC4F5A65B5D4055139BE4A2B6DA27188DE7467
                                                                                                                                                                                                                                                SHA-512:2A9B51C7763096F5959E7CCF7B8C3CB86D50B0AEC97E03CD606B4E6EEFED0AEC492BD7311B9EBD98F99CD40ECABDE14734E4573F3CDF3D6B6474EB25B4DA7A3A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Ertamis3OHwdYwul0RO9JOhQGcqrucCBlYpJzoF9HhkdbKwLZmh-0-7srvxeit64xQmuyBro8acD2gbLpDV3bEQBIJZ3Fr_nT3JfhJ1VhGGM9VOxiIcKkEGgN5kzoQkP77nbSEl0jTzfTrQaHADD24TnZfu5TYs2cdECjNWmTozwk62iymPw1Cwvpm_Rd6ScamhaJZKf7nYW89zav6C9qGfy97RCo9pZDDRpGS3YzzWLwexHZW74vKz-Bc5_UguvTFm2CQMRP52F_btiiC2GOa34q89ZwHSKw3gmym0xVGjHbu8vXpkD1WXYIHEHdLSJJwjm-TkUQlIbT1OgYYs594__jxEB2TQleNUPht9z7Z_bjLF9t3IAgmoV-jSYSSUnIKMkqeJPbHoPc7bTzYgAKQcNS7KgpFrTPnTua48TfBUtEwHMC-BMMsvEV_A6Bcgxx2W8-4cokCrSL8vdHpRIcWuf8apXCLN9sg6xoObFx4HkSPRTopJ70i04EsAXMsEOzPGQMrkRPEINAvyLSxzqjPd9D8NyfkzUALFpvBvVnopURXQAvgbqJVpxtSGzwJcLNlpdn7-ipo_o_hrBmZfnCY6E_xwCMFKH23Q3FQ88L1RznoADuYNW--2OqyascV2jSw_squmB-AYgMM6SgBN3cPNgJStr8ejEjIRHcHQ8K1RPEzL954jyH-d3ZyKYNO8CykEUOr1ixbeUR73oeRKZRBXZqlvHNahAlHn1d3ccmttTVWmdEHcMC-dgeRpu7LdyZxkI1bBPFp4dYNm-W62lpZk4N7q1JdLF7oetjmbfya6TxRwpCuiKkx4FQcdFB2dzBL3jI6jJzBWNCcX-clA5YiKZ8AUO733tgCjZXPdvWsYNPeipYzQnt_Rk1AEniOXYiZmfcZMwAx4IUihZvBN6ffTF-Wa31NFdagjKWPRckI3XZQSl4GZiZ3Omy0GTp-I4ymInkMMXH3rgs5frpzcOdaQ_OHlTk

                                                                                                                                                                                                                                                C:\Users\user\Documents\EOWRVPQCCS.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.967446955825148
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WNMOxJyksyNseaPlED/eJ6TB3B/Vr66hNe9FtKuy00iW4UlWTTd5Yc7eZmnP78C:SMO31sy2tPlEDmJ6TB3B/Vr6ENe9Fvv1
                                                                                                                                                                                                                                                MD5:3024F6195BDED30853FC38444660D786
                                                                                                                                                                                                                                                SHA1:5990D2E71B6FB58DD922C2A3C47F7D4F5D47E4D6
                                                                                                                                                                                                                                                SHA-256:9AF346510F7E0F2E65091981513DA51FFF6EFE8C0800D52F72B7958AAD373D9B
                                                                                                                                                                                                                                                SHA-512:907A4E8FCE6CCFA8FFDADAF258429C93C3ED6F36897E717FA2874BE16B7075E5DFC6AA1C167D3056C63688058201A925E834EF27D79747723FB95FE1935DC6D8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EtC3sJfMrA3A10EfPObeOGBQ-xx33sb6gC2cWetXuAw48RIxiGr83FwVKgDabJS_U3tF4IyyKUE8PC_Ay-B8StlvVXqW9ae2NhUDn84POlhMCtBjti8XfbNNV0Hk38zaOIN623d2-FwYy-egsGRy6FJcX9SeV2I1QdKloc7ICE08Z0eNhpQsLLs8XLyi4qg5V7VTsD2hXm-jB1mmiAKcz6mwxUOl_UNQsrcN5Lbqaqs1EMvASQp8462dh4EpOIYSHtxgJ3A6HWEd-tqBats7ou60WcZaTZrx5M4VLhZcBhp3E4M-_bC89CAOC5OeebvWIcHzScrXvPbCln677pWEzhkqKqUJS0SePUVxKAFCsQe_WwMULLUmRLdPV9oljNPAwDKmzcR305rQiuElhB0y7yLlvNN2LMMG_RvfDfIRimyYKq3S6wUi3b5tUYI1Na5hhR6EWv1SDRvRJ4IGB42Mb0pNDWj8Vbf5ZCRHMK58ovbRntn3hGOH1HU2vDlP1JacIq4xRDSMSv736lEjMGaR66knRS3BO90jCvtHKvDBLH3na7FY0zyIHjoXr2NxUQq1XzbpN7xVNzPMIH4NZ5DhhPpnrRByKT5AvpSjH4bxB6QVHVVST2zpO0T2E-nsFVN8f7kT3f0VNoCIO9Tupwx6i0DjsVMyhif97YipYEA08rbf6DrGaZs1-VY1rEA39gt8UvRJTXFX828saP--MPzV-OA3cbw9unQoHnXV48WUaj3zp2qLPV7xkN9jo5KCjwxuti-346OFOdUs6Ai1ktnpI8JidR8C3mOI2coxrHeb3LoPANSMSAj-84jLEuil-iB6F_lj58LrSU92XFSfuDEAWw9iXTvQn-DD7tlyiicFbeoKYKCTUNsiTxcGhFm2zFE0qELbivRZoOQLq2w0hKTxToWrPX6OxjQw72ZZmzIqS7wEPFpwu_4QxyLss3AyeOxnicxACx7W8P6_bWYEa3U7bgaMMxgD2

                                                                                                                                                                                                                                                C:\Users\user\Documents\EWZCVGNOWT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.961800652834938
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WYkXsyw4P24T1d3Hrw+OU2JeP+GOCRNT9uvVcLNj4CfL7PFSKTj8my:VjSJd3P84LPRNTkM1TLFNkB
                                                                                                                                                                                                                                                MD5:CB190031D6E7E69ECF79DA23AA40921A
                                                                                                                                                                                                                                                SHA1:24700557CB1F776850D7E94C95FE32677F372BE4
                                                                                                                                                                                                                                                SHA-256:CB4F923599C04B8112EBFFCC994D3428F224A0069F096D725EB0A9953E3C6B82
                                                                                                                                                                                                                                                SHA-512:EC89FD4A5CE246F79414FCC690A2E335BFEBC229AA3F84AF3FD9C41E1747B710060E2B3D003CFEB65E4ED118C476094051618ECE5889E555BF7119FF6C9C0F09
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E9DR_qm-i0dOQWKNvghewVkx5YM37qzBiTCUd7G6m9QbEUUn5O_Up92OYQOA9Y_yhn_EAgJZmewHaz5JFR3lbSc53YG1EYShEOVg3P7B9doyg2GIBx50jnidrWdQg_K8u_bw9--W3QprAceT08YmlMc1cDlc0aiMRVdd7Eh-OeXpm6k3bR-2vaqvbHxWNTVv7YhiUq9bpRUO_OeqsMPEtJBqUCVUMfhCSiOjmDqrM0Gm0cfeRur--uag42b7KDdUY8X3qonmpBBhQapPap8_r33sXMjpoYBmyhfZ297ahrnO1XRyfvgPxzIh428j7WG7uPi8TPlsJL-cHBTRV144svn73KggSY8vqzpKLzDOQ5hobR6ogzsL3K-D7AxiTYu25wm7fyMgKBHnQ0D_-SlZbksJRDrVFYylsi6tMkDxpYP-hiUO8_A4TY9Yo6ygwZyUabd6G5cLH5Bni0_EApqeEcsgm3tHbE5gZDmDmbOuX3chMsWHbQQ1HG2OzGeADchc54MV12CcB23hHSMEAMy8VBeMxvUnyIbwMQdwk13fmFurJriIIjPJhdN3jBZOYRI0JvYf9fkG35cM6_9LzMIKqlkWioYkeQfaQGZLsR5gF6U4P41t6fmHkP7GM1jr8mrRHlBhR1gRzwcsYgRoS2qTjZLArWsReHqdWFv3KYUcryt8ARj9eHtbhbW9g4KrrQCChGOxvK4s2hazXbWxxwjDvtGqReLNofHOdVeGl-FywL58XvLImqIoOHsK6_LF98QEevLs6wrkwGBjwM2hqcswn-I10A271UxRc3rAmIeJWWA_hRDs6Wvcdo763ErRgKYohxVg_gSYEBrK2iUerpPICzonUHeOqgNfA0C9IwwA5eKhwQuULTpc2oqSGHN9NfviohLLaq4tF0yaZ1FWRv5JOc2w_sBUNQDhE8VYrTWqtTBkK8nNMW8XDjIgonoozOrSS1K-KeG3fVmrnrLpc_cij_pfpfp9Z

                                                                                                                                                                                                                                                C:\Users\user\Documents\NVWZAPQSQL.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.970307710211231
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Wcah8w2eGxSZLpscxOrD2ul766Yc6zJnRSqJ+cKUPvIzB2I9S63GSrRVuKv:1aKLe4sNscg/hCJRSqJnKU3yb8qVrv
                                                                                                                                                                                                                                                MD5:2AD352198F2A36E16336B79405C2517A
                                                                                                                                                                                                                                                SHA1:4BFAC1E48DAC917808EF966CE28E3C92F007C76F
                                                                                                                                                                                                                                                SHA-256:8C880C81FE4B3C2F18473DC198DC73B69C9432B87518310CE2F6D2722FCFD3F3
                                                                                                                                                                                                                                                SHA-512:6B293FEDF03EB3CE848ECDC0BEC5C60FF708BF660BF37E1A8A083121382DF2B743C1762EF6976B9AA83FA5AB75FE8AA6673D00E37A5C8A16EA85AE29715CB1D9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EYpaq3CHQyXjH7kbY4hS4JHoSaSxODuybV2GcF73KCVuP1HIJulwF0gIo0lOhG61pxcDSBqr3d6VhWQdNQs1h2vyBkWFkn_vDSYN3MCdLxyOSuMsttholdDkNsN71MS_43BqBQhRB624Sokow6Qy6aLttU8WRi3u5kducJhD5UATNh7R_jNZolhZzzxxil_9FGXpMBDfilKoFFKSQ5ZKAlLDZg5aHrqwciakKraSwVoNJyWm1HkF1l01pLkx3DJQWk3UOF02oorcqKr_5qogp0fjGL8wA7_ouPdCks1D1Cn5w9L6zDdBcFcVNHLtdFNwMvcMg3arXzy1MCK0-PRB0A0X2Mo6QH6Du7wAP7iBOFUqon332cLPd31tFlFRUlSJ99rFoX_dKUmlGs5LEfRPxIeF8KwHqMMRxoMSpf20Yn4XRFUFmg4TAqSNW9vPJp3pEmJQ9_RDxxZTSRw-xtV7-5iRlek2NkZ0Ax6mEwcbJ6DaAku01bou2MtbOyZQN5wa9gXqUbKLUXXuT8gpZs60GlVQVWFLRz1ezzTFweAfBlAQkGuuR8hmezBP6HyFVUWqHw19IgnrJeTcxmSit6W_fudCnBHphBXVUlAdqYlyOzAX2UvK7O2L3Kk8jUtMAajdcwZNICmL3yFmewwhGNqcM67PowZer98Pr70Tw4DVpErMgxfZr0JNIoBY5En3XH5MwzARIpvHs3xeRQ6wDyaTafKzNb_l2Qt9N2pZX53SUq17L65ulMeKeqrI2jol8EV8jiEeV2wVLdXA6EHelSAlgkEwH1R75zxnnmvMaiO-VySUn4MJH1Ufk3l4YV1CaDYPae7nl1YQU1LL5_J7NKuH-mmT3wE2PpINYQXW7aWMuz6BXNpRjMME70rDjfcPTeiV6I892j76qpIfRkhvBZLTc87xq1OCCSBO2Exf8plHjOPpNbO2qUWnJqtZmlJkHndiz4ji3AvmezkK7KRnX23xW380zGPy9

                                                                                                                                                                                                                                                C:\Users\user\Documents\PIVFAGEAAV.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.974662108267478
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WQOwYo/MHdi77HPz4GyRhRGJu5HyPmWS/qt/mU7hnU2r33SoVbSl2lRuwUZptwZm:gwY0MH4HPAHG45Hjyt/P7R53iQbsK552
                                                                                                                                                                                                                                                MD5:E0A05751F5BCD14531FECDF4C0C17034
                                                                                                                                                                                                                                                SHA1:AFD9F2F4E82C39FC1CCC9E06897302A03EE27556
                                                                                                                                                                                                                                                SHA-256:9D08442E53A947F6EE7E8019E581CCEF77C342984E9A94183485D38AFEF869F6
                                                                                                                                                                                                                                                SHA-512:CC93F151565F5E9D2913C2C6A96F2A07E7B4B8B055EA46C87CA769D6E4226ED1AE2DA3741150AD76F032D7C7D72C0394F5C18A68DE02310A2F5108A08DC81B4C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Eew_FxGCIJoQJCU0Ej-JkVuPJFZgsZuXRivc7_lKcfIPOU4fnUhxTuyvz-cGu9FOFwYaYJ-Liyxxiru5B6SS1aiEKTrvp0mPvgDdAPHZF3BL6eeGzDLK0plUFu5fvs4_FoZsKKqXEqzfb785YZa2PxSIm5TkJ4CbP_pooTmRPb5J5qfPRoTAsdg4kmygWXHqsaf-EP9bZzU83aLybkYgwq1YRXkrP-GtOuerkzse01CQOKQEiWhppfiP0DtzCtULWb7DCQPczHPo23W2RsLhX_tPCm3txZNpFUGQh3vEEPJ3SC5_GqT4WQp15BhbShbLxqD5J2a1dVB2M3iG6xQOXk2scDz2st7gIUWtbXVJSbaKUlevcqWUg5bfcb_CosHPEM4tLES4L42AU7noNJ3qUqejrDYaHNFpXX7InY20B5bd8ttDdLEFkrzvnU8D1fOCdN9JVWAvT0HzxG_WPVDh6ZHR2Aa0mqff2PmsrSMZ6Xus-CqvKamozf6XAf7-HMymmzeKFF8Gon7pnW71wVeisBzfDC_GAw2o5RBmby2eoNzuEiG1mwQdRvrOa-dINfYE3OS2rsf2I3yPNpft9_4H7KNJYhzVwx5knYRXzwW8VeKs9FTUGTLGi4PFd6ZLXvbIQ-wmhulN2nG4vO_-3EYG27wKfy_5gqD2Mwr2vgyvc7m1oyhOJREk7zpkG3s4S-4O-Pt9SMjsTYave_yrsgZiBcPOy_6pWJkzhphuSu-pAH9E-SxeOGmy-GcrxvBFLLKpLO7Tl52F-wSJ8USv9MFQbIxsuYwKphHJBHtxcrOfbuhq8xS2m-xEfAmp1TZs6NF2HDK1zV3NwZ45KGOV6cpEEYoQFuG1Y6leWPql05y6s1K22aDJVV-_hk05FoHnNCqBhmflE6rVaT5fazcA0OLSml3PFVs0uhTnNpWPJ0PVLXjZOVDFvjZlYblXJLveURsMF8oKHeIEgwKT-JADYTu6AESCOYBQv

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9762563738607755
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WwO3MqYKMmqo48XT2ZYFW1yeVgd6LImNKxNrAdMAr2ujuBnz75PFtalAj2:sMqYK34bv1yeV5BNKx50TuBzVttqAa
                                                                                                                                                                                                                                                MD5:2E54ED9DD74CD030354D1BB8D67108CB
                                                                                                                                                                                                                                                SHA1:E1542BD849BB74906A67BEE544A8AFE227371404
                                                                                                                                                                                                                                                SHA-256:29465410EDFED53800CF8247DAC6EBBC0DD60DF8E0FC4D614E454320D50ABCE5
                                                                                                                                                                                                                                                SHA-512:697F646FCEE656C49D4C9C3845D9B67DA4125355AD9A75E28A1080C95A62656F468B73AE5BCF7F2E4AC1D1BD76B871220B1DA08C36D5CCB461B35C0D45C2380B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EFq6Cqv-BYziGYeI86fJ-FFZs62AYT-qQenANXX9yhjDUxuAoY9CdLkOBfxhEUISmCiM26OUp-f8lAePmegZxrFnwhY5muF21AiR3U6itGKa9_X-I-AjjksWa4DCdHMj1HahsJW0czF_lBMcE40rbvhSQoYfASm53w8l5G_uo734dPsrDRWonmLdzyqgEAzEtUuJQxbPGZ5oYxzxfvA5MYDTjhDadDmPy6PN1twHKd5cMcq-DAoA7mLU8LT43VlVLsntlZ1VtAiG6EQKxIwwKX5Ye52UG4KNZU4PTYBK-8efOhrjIbdHmgXDgXSaEWcKYaxxbWIBKtZ3ABOCcBAMbKQT6JRBeYQc4yaqqPiIePBMItLTnBQgT1_cuYV9QmMh7BuhYquZftmbvelBnLWVzzolinbct80J2JWUMWCtIDdbrjTzseGH8N7YixZlSu0vr9eGbnDT2sMxwATn4qxsQBhI9QfNti5IFuuALJAuMYUbhgZBn7ntmS3pHC4I8wExgbxsMebz74IW3mYrY8llm2Awg8i1Mk_8_c8fToTdeGMGfIJdaHRSXr6gBmaMRvamE0-UR7UuHivpEIsDtNd2HPZT3z32Je3TeQyQwZa1eWybXHeLO-J1_LD3b8KZK7hhonfoqz2C9FXCPGwBZByszVs3TolTWMBq-W2dpJtMUsPtIgh24aZXQINqJIp0FFxDVAuAj2Imw5vC7_mXkYFsr8jbzcHq2R-kVaiivEKIzEWyxJbhZHQ2anR8MM-uGFCUxjFzInYNwh4huupBw870Ds3MwN-1wqRRTcUKZGbVaFJQi6XU3b8C2qXIJQa9gJ7Wt8ygLp9ZXgPw18ry1IABigUH4T6_jxR2M2ysv-P2cGaY5K_TNQp9Gmb267QoshJ0P4nWQjvW_vEymqXAst1O7nkMOAuOBTyvxuoL1WpoR_40KjJDgr9ANoUggfOUTNg0i3Rd5AZwR6qCqPq7UGsCPO12BrMVQ

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.958279225815
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W5yHwHkq621z+0OHkNUYbNsbUVCpAKi5gMDYjRWaHxYmktncrfRId6kxNVsv702H:SSS6cXOENPbleAhgMoMeu7ncrfw6+Vsj
                                                                                                                                                                                                                                                MD5:CECB1DC8CE3D867997041C7A4F9D6C3B
                                                                                                                                                                                                                                                SHA1:8CF5B4C661E4EF9FDD3513B2E5A32E8EFA93009B
                                                                                                                                                                                                                                                SHA-256:D9FB4167943C3AF05FEE3720ABA6098CB12645D9A36FE9D7AD6DB2B291992C0D
                                                                                                                                                                                                                                                SHA-512:3A5AA82D7A14D7D67B930FCB3BF54C850697C3BCD571B8DF3F788BD91A601F221EF39EF19B826A1C4135E62D880329C6C9AD0D08031F82D0B4D23B14EE9920F3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Ebzf7z13OMOD3EVs1iwH4mRXzUH5M9tnh78RT_Dcv2M3G8TfHz4w74i4HPIFeJmmQAiA_A1FIk-7hnr-mGrqFuES5Eh0AiuKV2YDh6CjdRquGf41tPW9TENs7mFTDEyv5392PygTqcsHl9IowoaRLe5aqHhWcetv943xP7PbFTZs7F9uAMly8OJOY9mP-CalE_n-o5pF7Wci6jzMx-Soovz-M5kRspZ-rXTIIyOE5dv7Hc1h-1-n-3juF2y8KKrJ7mrR0_nzWM5Z7__hNTksYCWl5sUFGPesuXQYuIsEEeO5jseRhE1L67w5rdEiAheOqSqNGAvzQ9hoND5l3PDfK5CXxtzqJUqnraQepsVxggnI02p1k7T2g9MV9MjBDTRspe_I_mtbZmMM0NH-sOjsp4snmHHJGEu6hz_D9V_LYgE4GJJ8sL6H-7CHx8-EAqXpnM3mJhWErtHMYkwk4dyHWxhefyRopckM1KAUSfWkVcdLJmC54Q2evVfTEv5irpogqamprnDDbZ24HF7iEiSdthQIWO-LR8hAmcvsPVxK3_bvufE_HNM0f46zYVbzANhHUr6_Pc5jozSALiaHJUazjzNJdoeWusTXPVcf67COzcmMULyETPIaUx_N0zuQ_e7a4KEQ9efDJLrc_PPFPGi4uAKloGGWtbyyVfmH0IqwfeJWe4I2hss1M1pvG6Sld54VFCON_7E-JLqEThzNSHpdAZiSri46fJmb0CQ_NNpF5VSeV4JhCCTIpk-l-z8FoD35sTBfKdamxFy_H8vV9ZfPdA5akF7SgHJlbsi-XJ-0zQQpqfkGms1fYvsFVfY1Jaz0vAWZnrFVdeVQ3W-T46rHN-ruYdndGwhhWzy0Axb3Vbl4HQ2_nL2Cpn0scCEVjrkWiRYAaASLsRUS8n4TJQ7Q-NQshelWU2DbrLETJHgPi0VKE93TNNoaDMI1x4ohduNBN4darZqtKyGt_adcUkD_ju9ZhBpB3

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE\BJZFPPWAPT.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.960911394862071
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W8Ms3bwowwlM1qDdEYtalwO9KGF0cpfI37v0b3TGNTQZ94K7LYrElkFWW6vfTYHj:FNLiqx0KAj900b3Kk94SPWMZcIdw+l7Y
                                                                                                                                                                                                                                                MD5:9CF48DBF2BC3B345FFBC770F3EE6E71B
                                                                                                                                                                                                                                                SHA1:8EAD29C39A4CAA2D4F1B9A70A6A5F324BA1B9625
                                                                                                                                                                                                                                                SHA-256:F027C25F0C1D6C6CE234F11829262D1F1235C494ACA2DE59C0C8BC9A469B0704
                                                                                                                                                                                                                                                SHA-512:A7BE27DE75C764AB4886091F1FD5AEBB7F89FA6670E8C15330CDEF504E66BDA9183CB5F30D98B031BAB1376AD5159CD9B9DD90D44434E68E865DD2BDADCABF6D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EGfYi1s5AGLPoqwkJzI0jZRdr9Mxl1ek38DkqZF-1H4lD_B-2PIh6VL4TFVcnR_HY6kIu-i2yQj6osm5aEUwoq5NMjiUHE85t8ggOxQY92RlA55FvcC07rTWMGVT-60krbH_7hILzxXkLItiRgjgs2aDJsJdRVG6vFQBdcMHyAMQ_xrO_CNDiiB32a3ok9vp82wClT4FscRUw-zhPCFKCdpfuEf_IJwYHiyZJ_iHzpN1SgpuFGEuECOQGBI0dNYcH2-iCJzMuxWFpP7OiM_vZ6i2iq412VMPImh0DQklL7G0BF2_QGuoSgH5oaFLpz65uw0nIouFgT7Wilob_dIp--x94Sx-DbZRRkbBUYknoAfEaIpR3Cks44kU00DIuFN0Zf14V-cQQeBh-GbI-ZtGEf-m7u_03PMRxBRflB-vCu03ad-WmZ_fEM8extrZRjDw9gGYpfgZd62NnxjYmIbXjzDMvu5kVNYIPnIj9uOdCjGlWiMXvZSdRs7WeYhA35iaYU91vhEcuS6X7ZBWZLMvclS6EUAA-8IH-mZRZ16dy7Hn-mm2gr_eiuwCb2ilHz0-43i4XGkC6uG5DNbTwqtTXyV2h_YynAigRz3-iJCKifQWl8xSU5IcQKRmoEZFgbGc4A2Xxjk4T8FmbnMMPg66B755-y6lkk3LhuYtuGZTwLzsCDSSmE9fi3Ld0fVCINNsm_P12lClxJ0FUXPsgK6qnwOrWFPFqVZ8CR629uM86CI7Dnnjsz2_VHHVlnIX15Pu51UFYm8bWWaHdSV2D5bJVR0ybqha-Zop_D3vpwoK8HUwGoW8U3Zm7WNtyOAzTdV1-HPe5rLSZY1qRIWUQaK2YeQ-qUgBp79yFUL3fT9QdoWEhHx3SiBG8qPME4hQw_iv0DFt0fIiXb_iWZhxEHq6j5kkit07L1gQMi1em_7Zdb_xheW5iIwpumju0pUQe1_ZWH249NAMaYJnwUuX2HgIo3aUHrO6y

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.973417912432523
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WaoToDtIky03ExKxidsi5i8N1AiLKRjisLHCa/aEKRUtmRQ0VVFndsc1:vo0DORKxGs3I1AiWR+sLHRmRQmfZ1
                                                                                                                                                                                                                                                MD5:770145B48DCFB06BE950D2E00DCED526
                                                                                                                                                                                                                                                SHA1:729D74DD10BCB731938EBB89F844BCC316596639
                                                                                                                                                                                                                                                SHA-256:3B7AC3B5DB59AFFF894FDC7DD76511E47568632B7C95708EE5DCA8099CBD238C
                                                                                                                                                                                                                                                SHA-512:DCEC697225E283BAC2F7144A26CF157136755608B1291D74D1935BC9FB9D6EAB8F19B8C79EDA08E034E5C3A49BDCE768E0D87E78CA6B197DD48568601366B448
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EbqY8qMnLQpC82F0qK_BnsEPZBXjiiocb8XHVFPSe346O4v3p5NgZGq8R-8YB7ueY1uwI3C7vnrONPbwNsKRzPdmjgkvf_BJ6tjHdqgx_x78E4g-_sp46TkWUSuAiB2ke0uU-6S2TFuAXNs458AurHod1VxX_cyJSjzv35F8P6elLlAVxMzou2rBFQHGEBJ4mPb7N0PI2-DZoHe1vVURs6tX2rxd1az7i7QgPyJaKe_OhDDjNtU-4GA0As4EZdfNeShB5N8XfE5q4vhuWCAgp7dU29Z0K_IeG9t8lb17p-WrgbhEHdRq4f6ibD1uCVwUtFPpI9hbmOH7fV-T-YQqeVaFOsDRz_pRX5xmxRlPPNs67nMV7faN2rJbWyYvKQiIvpWmbnzMlT8xCssCFC6jYth2rEyze58sUYKLD-7L5QnaP_ZTaGIML7mpkLv6185g98ijw35u3xrvblXB8JlfhAy2bo_P8IuxA33T8Xq-5DG-ngc2BEvBPG8oaPDX2WLpur7NRL0FtIe6tExb8JcNmGwaxM0a_N_t4Y2mjMQX-29laKMzwi_vI-csZjh3D27kTpOqnxpNzxPsMG6DQY9gfQ1NWWJ94UyqEG4PTro0B7bOqhDVdZfOFJnIe8ff3MOXbOSFYB3jULpwUROuzVIcdgYzuOySgaV4uZfW6tTBRQcemngostKLd7WEaGq_iH06VrlaFvJrj9UzGeY_OllguSa85WmJM8xYJb1gwAAVroOGnvUzK2J7sodm8fR3xNOobG5k0rKHrV7vmvaz_p1S6lQNmLz5dP-7z_0OgHIcv31l2hkdTMWyVbJnD7TTNahjUAusqP6mNndmLwqRVva-oK5KxjWuLvd2_TTiKyUP3kGT-K8TE-hF7FruVmR6q8kp0fU8bucnnvX9DPngFmu8CT-q_LxH7jEsEBE_BTzn2hwygZ_1NPz-fpfaF3M9potURgCfT3d9yISleQrfDBUHvsKRE-l-J

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE\EOWRVPQCCS.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969497573959857
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WuOgdbPl0qDdNuPkXTwATvcohmIDXOHtQaUtTuKrMNtGDiQRdNF876RXgMvW+ueT:zpnDdNucXQohmDHtb/r0iEdMiruPng
                                                                                                                                                                                                                                                MD5:D93AA0D5E5A9151123E3CDE3B2413139
                                                                                                                                                                                                                                                SHA1:20C982823EB4C0D86125320A9195ABD1BE3A16F8
                                                                                                                                                                                                                                                SHA-256:7FF59E3950A2E498182D2947C12DEE5D26D849680845F0D1565CDCC3EB0D3853
                                                                                                                                                                                                                                                SHA-512:2FB23577B85935C54021A02BFC9F079E379964355B126C432CAD09702B9B7F059E38303FC356FA8C1AD28914F73AB2A0644BE426F254D0A1CDE6152545CC4826
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Esl2vqVxJ7dwa7_Bb1GPashlo-XhsHmxuMVIdVTEUOEM117YFCWn59e9OHkct7siCi3IyP_79x7fD1OjulJOFu49UnBCl-pX6SgP_PfvkPQX32SG2F5yGHZWTOmzTxjEgfcZIkM5DtvByy9q28TUAxrqDbTCmY2Ps07ROnEOWmYoHtY-1KyQIoDGl6oD5ImVvU5RllOkoxC12YKdAD4r1JEbjHTD_q-h0RoN150FQaW7Gvk5j7pWyDKMCFfudTCY57akHhWO2IwKFrUK-x9KiO0Yl2HWaTz7bTHV9TljqqDCLVDnHuHgcCugtRdAKRuxCY_-87giroynIw0oObkj-qFmncOz28URl_8_xWjB-fKotGQvhKdUqTIVU5SKkxG1RZjkHB1hLyI861TigfJlGiP2cE6wHrxl9jH2TmE_ihiccznBAWjQlbvOyV3k8l7J7vHJApegbHVDtgNNBBC3mreyI5JMS6J5cO6Jw8BPWHwH5v8OBwwhJw3lTWTFqrvsMPOQuaUS1L5JTPj_LP-41l1brypLdbSij-oDCjMHMYLLj_-JCQOcnBcOw-9cqNp2J2GofVFb8AWcV4HQYPucfGFpALx6kaeLnUBRXiJFHKS1bK2be6GniehxSKs4Rx-F8sH1DU3pZNHv39Hk3eabio-6LBQLVlXRXrUjHWW1dsMAlXhDfV9qVfdnneLgB71j_KiKJesDAdneDZ8bw6i-KQvmuuAuiyK4P-O5ZHMKpuIbrVpLm2mAXA41hPM01fxV6RIbnC7TpLkGJ9eGY90twm9DEC-IF6N86U1R9vuBBdAsD6wpO3Wts_qT4VQjhH7Bn7zvweUmQRJywooPELjx7s2RzEv7UwzepGFRmDhT7kjagtmTaJtAk-MPiGigeXotFwtpDgOCef4qGrPAamHOWu-ifkJ-crezv5CVL_BpWXoNlNpuBOsPKjl86xlvlCt3Ep85qD2Vb2rEoRin_aiY1xGphW0C7

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE\EWZCVGNOWT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969100637848877
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WF2LnZdRZR/U9n67byxYH8Qp5uogKC2PHrKSkZobwIxfkRSTCeNHuLZLat1S9WWi:dZRs9nX27UonrbkZGJkRWnuLQRz
                                                                                                                                                                                                                                                MD5:BB0D53ABCC27CA7563DADAF1B3D4C0AF
                                                                                                                                                                                                                                                SHA1:699CB5A681782EE877C7FBC83114B4138987850F
                                                                                                                                                                                                                                                SHA-256:6BF6CA37AB32C6DA0508A171C1E7D738E8AFEB5445E0217555BD2143AA39D01F
                                                                                                                                                                                                                                                SHA-512:1BE6CBD5702494570FC15B710C83BACF942F08512B6C105EA6ABA3B143CFCC6A12654684AD7B21C34CA35E0F0DF789A33BC56A2A1059BB9F6C9FC95D50815508
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EPHyAG1KBXRJrupBrw1gT4sqyQHjHIoQTIP0XICqonE7mUFClM-UycSOsBQxMbJINGIc0gMvFSaB0Zvt7VK_zH9M6WikR9KGREImzGnY38uKCaAEzpNbML6VINxn14G3wo1Ujk3gPWxGZIN9qRFjRR6-CTSz20Gl-zeWeV6zXkXklA1yDkxE6Yec6tBdLita3SK0bV0UGaK9vA8EBkmbnO7LJVrBPn8lNWFymYaOa2i1KSitLOgFokndEcEFvKe9yyXeZOr0IXtCa9_vuSWtNYU5vP3c7hUgtcgby2XbLRbSeFSIRdaIaUwvs6NgSJI-uzEMh9vYl6adzxVlF8QC0u-FYdojDgSUmCPAFCCxPoScoqYYvXMEx5Yvc9ebUBQ7RTJmu0cdzX56J4xs6ExBcyKpW7s2Nz8FF0UEi73fjQYpLIDuvdAsYfAsXCMBXD_xoXITPRMWddDcT_IcaLy3w-Uv-hYe-BnwcvPvGjSih2MFqT67u_tqRc0vEFlFrp0UMiUAocnXwnjlO4pF0xOew7jblyNHZ9Bbhd2bLA5BJIwofDgFzRGHr4HSFsCtcVCI7E3jrVSUB5Y8goIECNWaltrw4YoDZ9UTGhFG7SeaeP0rFdvp79BqvpincPLRmcsm0QmVZpkHw4j8d0O-rWESNfu9QbxQCz2V5svcTuKwGpgxyDDUmWPbM9a_Xy8hQv_wpa90m1kaeoL97Zrd9fNb9A7cUxp2zOSqXL4vxdXb9Y5vl_x4PVFyzUsYfkt3ydzNNpQEsUbo5CEk9LtRvq-3B7KxgDlxdsNxt4l5ARQ1vrLwxd98FMrYYaMPaFuXqbxADP8NqeH0UpluDxtV_0sqTxNnzBHE1uaB3KTKSaieWatHLBrEhEfmp8s7yxWa8WbWcof7D29NRCNoOzP0x2zaw2Lcx3xRkc1xMZJcwxL3wOqAvrM7Sx4yfhQ-5_Kk6E7oWrCPT92Oxnrp-SMyMUN_IUsHGMrwL

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE\NVWZAPQSQL.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.972975503804576
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WtK4EySr6JJC8zR3vgNlViNBiVDb926ZK8qZ2tozF17x1E8ooefeOppZoji0K7/N:KK4ED6XlJ2o09G89SR1I8/emO+eYy
                                                                                                                                                                                                                                                MD5:7AEEF5295DDA209DE3D975009EFA1186
                                                                                                                                                                                                                                                SHA1:5B6D2EC7268D2EE94F0C208F570CFAE61D88CC08
                                                                                                                                                                                                                                                SHA-256:673E1B2C0033523408DDC2B75862FFB7972DF10A777FBA5F85D0B63AC3373DC2
                                                                                                                                                                                                                                                SHA-512:C178BD450A026BB6426A575A52B6C1856A344EB24E1C8AC288669C163F81BEFBE755F11276EA6E81F1EF896CFF9BD42A551B93E66E2E5EBC72B805063F2653D7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Edn9i8_HOR0aSNsLUpRLiBDGXcLftcsq_tq-1WA3shYdA0C9roVD1TFgWsNhKADD89YHyrjA-hWuB_cB5rtTqufvbU0G3O-UDTXPcK19XCxjDOI_8-doyY8vplckxHrCRVjd8RfQ2FmxoBsX2vPyUuudqfio2CjTpDd1jgAnhZbLYOHjZefNxcjhUIm0ds0Fl1VGrBFI4Lz5kufXEnK_IVkUWO30oxlnPwGbMMfsPry7YOQsSYdukV2mnmLYw86MO5GkMvO9ta-CQrVn5upJK79OfD4AADB-UW7TSIrXwljQQ5RqTsht6RMjVHi0KywgeZvnRXpr3VLRRpsl5Wo5y-d5x3fmGMYGD9cXBkvZbdrnR0nOCo8Ryyih02Nn1nNuvZpP-DKRl95IzKZTkWRWkuHLBxU-nBXAfDcn7UdL48cmFLzHLAMYQ9BzQ0s0n50eChl3O_UTA-0SrV9b9cGJaNKZKvXWSkCTcRpSHbGuuJFFcocizUcSh8zxNplHKAGGlsKTk7wBlKbqzl7QqFXqkepSm2nMdMpTqPdWq0WvakCbh-YOzwGcM4HC8LBMJZT_JIAZrjsb6p6V2sCBPet7yafrtyMy-Dhh2jo2Xu2yC-tTR7a9hR2Hdx9BSwSzvCbyWWn4b1HDJSMP-EjDW6G3FnYWEUKiVGBkEoozfW4DTtSr7c5imJpf5rmogicm1L14gh9l8UpJ3ZZuJz6hV3dGvnB3rDk0_hinVW--_W0YP6JuGLxNbwdtorOCxWiZvDfbqo1kaXmcRoeRmhqQBKqrVBNiq9fZbbc6ozYbJm09Xky5KRCkS-EiLsjL735IgFaUYqkc6pVPuFK6g2FBV-LAa20e0dt-U621eThZjUaYjQ0wVcosvqrgh75e59YHa3FnhV6uCcpovOEZJGvR8xBjfoALGTcy1hPiF9ILOTkTTE_7wGB4Y6iEOhSnEgBYYlkqR7E-pqrTZeNiCaCPxsruOcQxyPduc

                                                                                                                                                                                                                                                C:\Users\user\Documents\PWCCAWLGRE\PWCCAWLGRE.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.977733926753326
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WHxpag1XE6yAeIF/F+q42ckQ6uhQN9zXpvPJesK63XMW9e02DtCRj:UxAYXXG+9+qEpC99vPJRK63IXc5
                                                                                                                                                                                                                                                MD5:3FABACC1FA22BD649F0F1CB93C41FF01
                                                                                                                                                                                                                                                SHA1:852161BB11D522128AE5E5A9234983BC6856812E
                                                                                                                                                                                                                                                SHA-256:B841E8A844B6487991218458FCF122F2DA6EFDAB3734DDC8A72B0DEDFFC8A769
                                                                                                                                                                                                                                                SHA-512:6F38994838466E583D27EDCF74C0C4E57A1233C6E9B72EED2A6314FFD45B9D7ADAA0F593F174CAAC29C0F8A1FFAA45E88FF012DDCFD1BBC4AFB1BC685CBBAE19
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EOeFjtWp3fvZUJqYVwGKSf4bcm_rYqbYm5mmItMfBZYTK0VbXDkOwVvuj3bg19r9r2TauRLpBu-d_xBROYTjgzEhcqIiqeQGQfdY7hv8BTWETcDAz925OGpYiuxbeNKG3yeuo0T0Sd0VsjOTxZX_Su8X6Z-qfLXWiD0jFgE2odWdMyiGQ1Sz7brBU16vuebV-gU4WWK8sd2NC2OQ8xSqwAQ12r-8zc6msQzCla7Tj9bVWxDTcqZPHzya8naFN5RKCLS2fU_Yp3S6cEPkxLjN2esdZi7HvF87rQ_aN9j-ZZ25SiJumDgbht5hTkzEABQB9qVZ9EVZCM5tUpIX-YvaiiYhryjNdi8llabMmgf_Pp_hsN29WFCSYjomL7119gLkjN9umYNRFp5yiDueBwtZ9lTqMi5tWscuc6MFID8Jmhs69NYKSuUVoCWQmgK987yFkH9ywOLo1ffNioEa4dtCCV7ALKgdGpOqQKmfaEsnw_nc8SZLsMvB3MA1oFkDs2VMn3bCFwQwsbAdwXtYQNHGLJ-wBjVIC53kYJbBT0JZzxcNiOJcjuHABNKmvYgbbP4bbr0-EUTUFqcLLaqFcZcISWt4wD2ZT-srgaWsAAANh0bsGXdwcAAYMLtWXeNxkwF-cl2yEvx_rhTm6g8i75T4Ia6n4JmKL_p54D_8dJ25fRNquO0PxCWGwNhSUlMQlH3O7I4mb7PhfbkJdGPeNvnpTwius3kHOUU6H1ONVEu2PS0RG988mOLYLECi0faddpFkOSwo9xJqvyTt4gHpcK6f2-T5ccATRStRUsNrxl5RKyk2RYMj6Ge-BTfCpKgVYGX4AJxmpcVlCsfsAy2BDSzBSAbZCz-_IvJw6jTA5NMeh4SK4BzAUVuwI6BeJPrs6iqPX0_Jppu_OS3l-knsu3drBc9qIc5LtkqtWa1E6FvT9hcMJuOTLIsUTeUhqtsB_Gij3mhF3ZVvgi97dYL-JgQipPTO2pc8x

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.965810412663684
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WjawTnzDlzIDroq8fCQlOEa5zXhHsTMFi2qMj24llKzQrU6c/dm7ch2V40rLw/AK:8jflcDroq8fCjEa5zKTMFF1lkQQ3/qfk
                                                                                                                                                                                                                                                MD5:23D7DAF4B9EBBF1A683A28E678FBD198
                                                                                                                                                                                                                                                SHA1:9CC6BA3C86DC79894CDB77FA1C610136F86D8010
                                                                                                                                                                                                                                                SHA-256:984AA8F54F358D5CAF2C35E1E44413A7D5DB6C15C4FF556E8173CA9CD17011B7
                                                                                                                                                                                                                                                SHA-512:C788D3727823902138C19031DB7C7C3947585EB3BE52801CCC8488C75E7185134D41902AE0B6790FA844AB9C822503E7F030A34983A4BEA05EBF04B256B91071
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EixivkIIvbKdRTQb-Eh7xCkf6pA6FiEmsdWM_Pr6AkqPdmk_5gcaZjUwvb3E4MOiNK235Is3FSALuldWkhgKPzRE4T2mvLRqLIDE279iTZZ597has-bpngMJs0OGABv54YRXOvCuMmqkQtukwhIT9u0l3GLVL5vI3qqfN6pJ6mOSoMc-q7HQmjmRinC1slNbBio8wmJBN1SrOAXgMpwpfuFWnLli5I9j8K5QvFqZmkpLwbcok7qbdQfKHJscDrv2ptkNzsjf78ahMjqyaqujMt5nOL8XkO42gMHDC8wVcsW5dj3jG5ToGiF3jUChf9acu9HCn9jHxR6l8sOf_JSChudIziKJCr1PfeldMmn3HHmsih1hbmKy7y7mCNU7Xa_BE3jnikept59edrnPJhHXzJI4_tuDIRwxltsGeqP07bTZ_KrFadiHtOgty3qFZCXadGX9iuzAFKJ9vqQlT4bHVee0Lq0o02CH8IZUseAGRYe9UbbXpG_rjpM_Tp33UtvJXRI6ZPpUGt0RjKhL9qJb5Epm7mhjLlvmTF0SC0kU2hBvFK6m8PmXCU23927x5DtHepIWWpH2bWEIl8rXgzH41lO6Elh5j7WCvW0kSVKw_VSBQ-zKyxcqjIuAW3TQYxjNiyr2eH1k3JDt540ocgQgWxd9gCSNNv87AJ1Uk9W4xqitLgVtjxCYTZDtv9fMRmfl5u7cEQ2_K_2enGJ7ItrkyKR90lfNT0KPt6g8uGSKwmNpF-hjhhjfMGxFCsPsRO3kido1fogM4RssjxJ3IytyVpoqrN2ya7ckJu1o4cFn1czWoYQo7TUVs3V7_0ZxBnLPVI-9c3LjGLsHFjgR3VhlB7D6lluTop_UEphLSWTDv1WFgkDM1pKfuT_g2dmJ2m6PN3P_iMkNy3CT9wyaQ7NL-XYtGG_7T_rddzH-_Ejlx1h--UUZfEFBokL3WhrLJHbWIJ1wpE1VvACtQL8s-pvNp3OFKxebS

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.968590095337656
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WiFLzFzPCz3gL4e8SXFBaQl+IOmhAocy3ud0gCAiQAThCMyOhQggtUJ54hXNpdc5:rdPCJEaLdmhA5WudYAiRNC5Op54dN85
                                                                                                                                                                                                                                                MD5:89F44C1DDBD2828B825A3EDF0E13852A
                                                                                                                                                                                                                                                SHA1:1BDC54C907A732A86D8F3294849EDCFA440D9419
                                                                                                                                                                                                                                                SHA-256:7E74B4ACE968AEF9C33EB95E37385D8F4BBF11617EDFDBE56A977E74C9055B15
                                                                                                                                                                                                                                                SHA-512:8437743BC6C62D9079ADF3D1C1A6BB6B8AD4EA34C4CFE5BBF3F824D6134A8314D0B63D3A914366913EC5B16B412343DB2492781120FCF0FCA681F8C0E93A0A41
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7En48lCKtC6vVKSBcmiabP-DWNNi2e6cbGuEtpsq94JLlbAzlD6IWtgOT2KjlH1t-rUEG7ibdpUsEMBxRv3nXp2om663LHpdY3vAXn6JjQwaVmtk1mxUct9YFjcPDS4KNd_JLPrjxnYbzVTBt7dMnwGEsH4aTQv18cNUnYj4iOnuqSZJ3C9S5_MfK832FeATua4491_qQKe_5E8Yu5wq6Q5Zj0BhuWvqFHf5Bvoe9nGf8T91ipcCB36QpKXHxLBVZkmqyqUDaDAh3REnbjQmqwcpjt6S4eDseaXtN9kAi9QKa6-267GzmTGGx9wVhk9-V370eApv_2dzC2dEFmiw2iOuXFEQlfvdjDwmiXRY5n0nNxqYQuebqzkZudvZyDhHkx4e3SOd793WlKZzSayQvC5kktsFx-1dxpC6I3gYlhGtMhd_VGzA06d6oYpRdhnjtrx6paPoODMX7ZuYibE8ePXNcEXWabrGI1DEYYsCzUc13FtIHfpDRveCqy0AtItM9xXdJ3xHQIPdoXfitYX5xytdb5RlrOcKz0D_sdHGvxIYwTAB1T7xOtBQ7T_D6HE9jx1rtFf8u6k3Knf0yupMlPLQVYSnMRVqunrX7myk0yBXEy4qQCZjHXaWn4W935m9fBae6-NppRP-GpXypWoxgYsTI7lgtey0qrmB67ioQ2StyVx_mRNhyL9Re97vsHp7mzaSDkzidJlsyenHs5ERisIrI55d0YacDmKk9BGX_ifAR8o5XlBR_sHy9bLN2TjKaiN0w6o40JMKF_TYD7e58HreGuQmIsNYgRnS2p9wSeMYuda34lgEMyzZB4WLhNkpFLne2okeYJb_XKWtam6kB3AdCNVlcV6oMeLipwWycTLEZ4uzYmZU10PqJ4hURJI-tG-etVNPKwFTFWBaop-G_fBxDAJfv798g1MaQXflJk5meFTxhm9AmYQpm4-EaZwATwGat9oQ9X1rkLm4ntVEYWp31TsRJP

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA\BJZFPPWAPT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.967195139421108
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WPB3TT/R7CteECJoOU5lWsZ9Eu8C9zlPHM7Oy9D3fO/kNX/q9YA6wIgSdt4XXV0f:a1HZweEYO351SOkDmkhqSwi3Qlt+p
                                                                                                                                                                                                                                                MD5:2DB5839A4CB0E114FCD11AA8A7439A0F
                                                                                                                                                                                                                                                SHA1:76BAC629296236DCBB1AC7046C7A06525162E780
                                                                                                                                                                                                                                                SHA-256:0A3AA5F29F2EDD1A85879882284529945268E0E1E6041F2D89A41C914BBFAD30
                                                                                                                                                                                                                                                SHA-512:44A39C2BAF0EE19AEE08F07BA3D10B0496DBED15928B7AE4468B235020EB062D4704B8041103F7F0121EFDE8A8D65823D63DCAE3BE0F8BA9BA997E51458AEEB9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EB_aQ7z_UY-o5AhTNMhNC5f8NksrWtKxM02hC28v1TFwTnNMVuUlNGxJ9ziSj3m9nlYhG2iYD230LxMUMuU0z_DplN8gacguzPKvAdNsE6CMgjkipAbHtKfwt6heKCCMPm958nYLhSlJ9FbZOBUKEBZnlAnjvvqpGEvtKXobmZND9OMgOjtfGoCTV9D0QJxwnd90xVlvbcZyqaH49nxwLj8DYvOyQ82Tz0MfCeb9uGBtcYBS9Ni8m0moarqnmn-2acLzf33JY8CKKlea5-K9QCJKpjRg_zppGpzDq9hsMEM9eTZq_OhwkEhkgaU84U0Bu3cNHWnIBptPtSBsi1FuJUsfbgAKsBclQiwL4M74bVVwi6yxlFP0caZH_69cVjqOcfvLlSS1aJOcf87F47l1AFuwz19meTYutMHvoc0NG4e4vQMUYIGCeSsEY3AJeFK7b7XHKE460mDyk-DZRs1IWE0cKUXde5WARM---WpsS0GulmeX6FKVQUM3OuBisYIGQ7TWCollj6lKjXuxeBB5AsmOKeTcHAeIeUZw0ahRY3rREpk7Snj1cPh_58RD2OudCV_DuTA7SZ-CLeIyjiOxH347SvQ1BDM6--FQ2OkXPFUaJDzb0rH7_WptLdHvXQ3B1ZoMCRZSFbWpBo48FJkVIZScg1FosADC2ZmcVwM2smVg6kenAYe4R6Htg3oOWlp9aWqD53J8Zqv5CyO3Mp8-3Q3BWOeuUQ4-C0SFMPOyKmxvAMoS1yxYj9TiZgRj57A98zr3w-zIhoIPyKMnjCGxYV-ysQhhZQf_OjRH30DvD-1-PIJK3fGnsV7ECNarACzM6yOw2DpgC2_heS-jGLwSGj0AwYQKWYz7OMTngQQ-Y5a5-hzNJ64WKoHevlIyuGaZkVDA3dUrVgwnyIja4cxMQKJF0_K2ydzAY3TU2FfXZF5_69xB_RqlsfYoFUSEx2jap25OhOQ_Hr1t5mtBIu90Pn4GG-hgr

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA\BNAGMGSPLO.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.963233353841549
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WKNXhnJMQnPj/eNU/UttD0YOBVy5kr6OrY5f9tDxQ6jihl9BSHeffiSChunDY:dNRJNPCNUwD0Y0Vy5kGfp99Yj/SHC8iE
                                                                                                                                                                                                                                                MD5:A00ACDDF2C2D005BE81CEBA263C87C31
                                                                                                                                                                                                                                                SHA1:F841ABC948EFDDA917C4DA31023B711889509CE0
                                                                                                                                                                                                                                                SHA-256:0258C6EE5368D42B743FEEC4F54F2C714E0235F8A26CABB5B3E5198A981C79E3
                                                                                                                                                                                                                                                SHA-512:103D9127381CA3D06B08B7F14DAEF68A449C6333FBF308842839637DB2CC2AD0815AF2965B8C41A97D8D8AA27EDF5E5521119417C7968EE9D39B25C0FDBDDCCB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EvsaYqtVqiMy_hTQd32hk6WCMYKNxWrboXhCvax0_0q5bfziyb2pEGgWzCnSSIaMhy_LUYTn8LUKJcwWpgz3j5OEruihl-_4jjM40S_bJGmgKMtTQjySuXQLRSYRM0ZmmRjR487zTPcXovAHIeY_rE6oN7MNL6RnFwEK49iDNMgBXAaDUSloHLuVbz7tv9IzBQ1i6DH84AcxYwIMDkWEaY_qfBuDLRM-4oOOkpv-aTSlqo4Oh-kWR1tiBYVgHqqRgzCwv1NsFlNeViUn0TY4NdpNkmf2x8Nx7Qv-554x9DT_p_L68NDCJGURtVYIJGtwhUI4VYD1lQ34crjPnSfIGahIS4UY_lOAYw2AyP66rzVaum18jLPE6nerlS12jp0wU4Of70yNAJvOErLTi6j-IECOZmC9Bfmjyj6aCMht5B0pwkPiNKr5Fjq0rwII9qylug_DgdVz8HdIzuSTCl-n3a6nytJyYOIwOzXG7Khz5QwrWMivyylYQrNHKn9Ka_vgFlg30jKEtD9AMj9AIffZBA35KTQaSHzQHkMYQ_LNIqyVv6WSkWalZL0YSEGmVPjNmNitE0L9g8f3SghEzAmQHIOfsvRxp0qzIHv53BejXqF_Pkzw_vGRk1DhgGpAqU6BG5IDhCUXBWjDqwcqJt3Yq8eSPFz1ggfTMIUcz9jUpIZYL3LDb8672dRwMhSDg9kTqPhpvfBoXkDu6-mjo6b536NvrnLcp-1cPow348hQ_efyC2NSKPGrkpCLXV0ksE0ysG21nMtKIxc1FLejO8YR9yqsGLeA3ER_L84o8_1uI0FsGBV6hA-j-214Lr5moZYtaF6Ksvs-rSVfxwxjS_K3oAbulTWvZ-qBtvrOTVKcwA22JwXydZLY5ANv63QuD_NjFwu5jGj2YKou_YtP8pLgUNtGJp4F16AAHsV0-1rRJTbNMOllXDVrHvjXXLwUP9EiVbNli3vyLEXfmSlWaLcb3Wk3zy29e

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.970465421460648
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W9GbJhRHvPEiigBk53ujLTwalymFnxu5kEfZndu2ewGoG2SEt5D0427D25FcX/sc:xRPMiigS5gVymFxu5kud5fLfGUFYOe
                                                                                                                                                                                                                                                MD5:910D5335F74B350CBA2E8099644CE418
                                                                                                                                                                                                                                                SHA1:BA891B59A8FC09F2132DEDFD949D0175F389607B
                                                                                                                                                                                                                                                SHA-256:D972F615BEFBFDD701C4D02EE796AD3662487140D20CDEF15BF2301190B1A081
                                                                                                                                                                                                                                                SHA-512:25EB252E55BC70A682523A6AF71B6EFC870A59EEBF19BEEB81255B0B0885894BF525E183A692D9EA65584047B806FC0BAC97744FAE22C7F049CA5C55D652C0EE
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EVJZy-AAdyrutsvSprgarmJalSHCRxqGjetzX17ZhgbwMoFdB9FU3rb0a-XmCTN0CansDFVoVj7eZW0ab4oFqIgaJQgudRNMOq1Tvd6vaFXjJ3lZ6nabQ5EFQ2wHpc2cavb0UnsGhCSggcPTQwjWVR4_8oqZdvzdqMXxQ0repxun-0mynqQUU83xmlUvHCwiZXFiHeZnNbsjf8f8cL4ER2Ax8kFti_RgjxydK2e_jRqrF07pOyZbCaHP3gZ6ZAmYmoOo7sX1XuhIMQMNpDIY-32jMEowZ73-CeiQ0Frhv4bf12Nwv_Fk3DQod_vSGwKMtUXKHqxyWvJZp6hqtSYlLGv6Sj9xeDSYpAmAC_lzQvmAIouz6m5taToZm-_ABNtfbsJ5tULA55hCAIrXGazSpvJq1T1mRFYmbdg4PCfFDX45FY5ZC7JW4hV92qHrG5auKy4tgtGsTruaOpvUwhISfofx_h9aTGdthMMWtSTVXvyqVbBW3VDMZ962xS35Rta3A2Fs7ADr1mxLeM5xklAN_CmaEpGtSkLIB-RuAsTAceOITkkdKkxVySw89xf02Puq_O7Stdg8Drv16qJq5N4d_9rPs9tNFdhnqKmMhRQW4R7fl3fjLWWKCIOJGCw1snc6BaT7zge2HqiyVSVEcvSvPjWuBPgvrDyKzUNkjiean7QK4nagItMWvauLnSO8T7enFYyjTHdy-h2ZGsjTAWwiVUnokU0Iy6t6BOVTiDEJl3IMwOfpteFi9B4db0qNKSkt9NdzeypuYLf18qEkTfeaquGFthfx84Ff9b59DjJmqD9SRUyx_7QHnOPLYVUwfTNMWigsgaGh4RSnaC32rRmNoboN5WFNTV70rpxJZhwxH_Wrydh_1IGctGhxUU7z5o6g-ih684T_phXSvL7K3XYSDCjXvqYA7ZNt8Py6QgTO3GRKJT7wBvMyb1vZceu7-5QU5eEYatKNV60rips_atSTwRkq8IEyz

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA\EFOYFBOLXA.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.977696714182063
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Wg9zhV2fjDx9g4s/iV1a30s2L/kXrzM8uvQiiFouO5IRYDaeWhPDrA3MsuDhVDov:bH2xDs/2KqL8X4vKrgieWhbrVh2
                                                                                                                                                                                                                                                MD5:15787FA7B3270B94C38AF305B7CD72AA
                                                                                                                                                                                                                                                SHA1:A486AEA4D33DF09D44A5077860FC115646569A44
                                                                                                                                                                                                                                                SHA-256:91F6E3AD2BB78C1F750B97514F78711ED2B2D0AD4E16CD0230744A7F79FF5DF8
                                                                                                                                                                                                                                                SHA-512:C21E11598BBAE08268C5E08F517ED4874EDDA730BE3F3058F8D0FE542F3737FDD515BEF508A16BB206F0E469F09D66D522E92DB1B306CBD61034A026F88BE8B8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Eli6kHTU0x8mBItaFHivyrYtueZN2uiY0U8RRN_i68v3GCS4jJeqxvvdUhqT4eopVEM8VRDu1gh3VYC8EJFPbype8G1KEu6CwH8_DhoB_YLgV7aBGlX0jIW3K_oBqCfwly7bmyT2sy5yXF53jm5X7YUzG9Ka9JH4ZPb7BGaqAJt4ZmhFPgEM8ohLpnefDSRHXume0RNg05WEpu3G9aHwxJpsL4OvF7WEeyOlnXjUr-ryyPkDSW2-91k7qEhtbG4qZbu_OfUWR8DVMjlQ7LQ5PPpoZyw1wFjdpHqO7lxbJNo2V5oHiizXsjXbAIYYAFjF--HbRs9W-3lV3fQs0ZR64A-LP7ZDixdcIFd3U-BZSWkxD9bP6q5ebZ3BdZoWDHlFbvPybSu_SN6JSAvstESdiRirHMsfCD3mYZxfdbHWHHFWxZookcMzAuXHOGeNNDxe-2vmZ1Q-dSEkW6bev80UroRs_BYrGPAEhgv5FuVKtlj1vP3JsSH_gajvUGmEPa8oR_ZdCwUIhY9tJfkS5dBT7yO7Nv8D8dBbeukMgFOVdWu7jkwztqwxZ6Ec52wbQiCfkBfqFwzG_BI6EDExjlac4Ak2FiU3wfhPZHZdeMkqHe5yBw8vCcGYcn4v_NYcVVX7UXI1Uyl5uWlBmRo9KeSd-mQQtejpm1hZyTuB4CVFsGYJwfsPzMX2WckY1aeW1fsSW2l1Hi9mUxNCowWyR6G69pWw7d5THrgA8GCBIot1c9KHjL764e5ygH_U8INTXhD3IVmZSEhp0iOst6PG_EYSMxOVy-Gu4tQINEqtaUDieV9KQ-mVmlrHbXUtCYr0uwrP-S3w2B-IglpTlLZQSX3T6pQWyyb5iKW1d-jaB7TRJcp3Qb3cwPvtJrz9LnFlHihU_zShsozTxakvQmDTA2Gou89w6r2ixPPxX-t5iofJp6hsKmcbM-fB3Kb-d9uBUYa7VxNHcRu1v3d6g-HsMs-CUmMrXbEgL

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA\QCFWYSKMHA.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.981438728142804
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Wm70oSze4/Qj2tARBnac0bW6U9BSwsmOejpiPqSH/McmCrqmohv0c4jb7SEdY:p70oS64HuyWrFstePkfr5ohYfuEdY
                                                                                                                                                                                                                                                MD5:BC9C2CA6116FB5EB2EF22E30C76259F2
                                                                                                                                                                                                                                                SHA1:579AFD83FB91D6479AF602CE09347962F29BEB1B
                                                                                                                                                                                                                                                SHA-256:F37E571DEAA3598269EF4D608B5C06F7B9FB443B3C8ED5475C0CD7ACFFF79280
                                                                                                                                                                                                                                                SHA-512:DAFD35EF5C07D8F38A22E6FEBEFE596165230E4DBBC130F66AC048E0D4AD9A6E7F7778A10536EDC0DFC53F4D167102B799AEAB4D13F0409F36F6442250C25ED1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EHwVF-1Tq0MwPGVvMc5sVSGBjC2x-AOooSPCZSu7airfPWqCOSZPn39pMdaFtPj_RvZGb5WXFSpK0BMiz43bhRq8EKozgyz8vsgHCO1KdQ91v2AiYPW8rlaiPXbBZUuUmiUXx07yX1QNB2by6wEoxiNbkM3D67ahagZ-vLlaHsSGVrBWKAXDhpZxRXI7vfQK8mo41DJ6TXU8EccTrr9pE_udHXCcWV3rDFvFbVAJprJiQtwX8LOUXfYAtNbdq7a_jAiNQimoEm7-b350VrQJet2zO5xukjWQIhfdhwkfKbq1OGMIA-IlL5cyEfzhFbQ_xYGCsaLy2V8Tj9NNZfVDFxfjn-3UYrjHBMfhjOJDnMYARwa1DIOAsYlNtblPpf8Z1mwyhBKszxTQ0Fc0cLQ9sOnByj2gyLdokmxcxsIpVpZDskhkMzuaTX6sVRCuNXx2uEclo2riHBUCVLNttLNV_rP8giOHv1sCDkAngK-PrgZ1JZXG7G2rti-ICpjpfqi1TDF5Hs94vg6lCTvpKW8nTxDzgAhv9i1MQeBp7Uv00zKeX91zQQHdRgFZWkgUV-jHf4_szj_ycR6DWUTJ2sJsFU8fg3S4tvYLRU_YZHjIeS0hlbs0k3P-9EOGu6qRp1Pt9WQwMeJrTKqyh6E6R1TJnfo17QuJFNSGkAWc-3XQJcIajQaCbthYj_L76z1vQDGg4XyZJo4Vw3QEg1Qx8ej3cnPLIq2DbaxAzb_HYJdQzpMMmg3QDBv2V573HXZmgUL1R-0a9uT_FH9XWNmB2ckugKpWnP1Z4hIk-JGzheVJv6Nr1RFUz9cBJQ17PYoo_tuoPq98igoWIdWhLjRphfV_Yg_75JVJVCRvSb86KGnBmE-drt7jyEZj_lZVqWGq83TaNmkQwQfeZrPTw0J2QRPcmNgO8Jm8JwM3lBVdi0ng4AxahgJwRd7hOBRFwINvPj85zEvpoBoBKtbYTiiFN4iCrehB1BW3A

                                                                                                                                                                                                                                                C:\Users\user\Documents\QCFWYSKMHA\SUAVTZKNFL.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.979173495430581
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W2RUPCgFsj+jdKZkByBm4GAxa/l519/rLCbH23AxPfk/jkb9LXxtVwdplPp+9Fbv:MCg2iK64GYa/l/9/sLnk/wb9LXxtwlPS
                                                                                                                                                                                                                                                MD5:9A3D4386F59EBFB21A8A3F14AEC8D856
                                                                                                                                                                                                                                                SHA1:A587DD56FFE76BDE5C70464E9BFB0394FF30831F
                                                                                                                                                                                                                                                SHA-256:675E5FE284FE2F861C6B49818A2580453802CD9BCD7DB2660AF29D70E2687E80
                                                                                                                                                                                                                                                SHA-512:1EDBA83C5A3F40B24089875C43C8EA09EE97D9E5E862E080155FDCD674B4AF1612CAEA1AB38F9AD20EEAB9CB2B97452FF190C9DD38CF11432588B9A6B5E79BE6
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Ez2QxnL7UofoT_MNX7FXJoxWxQMa8GSeeYQ3QjDD2E4V3UvDQHzr9gCpFC0PIkrNtbNn0mZo-zuqFRXqpH5qy-lxRpokFVqDPnMUBRjLme65teKbMSLNJliFzVsI04QtHtTHaFO98Sn8ad9zPljctD3aX-wAqRcD7fRxJlvcljBm9nzKqCJ_CJIYgQq0f5LsD8INtXIsn99PXXrPpYs3QcX77Q4ozqSQRzlIYhBa0NiZ5OCwkDOg1JGadGhyxWkBw17kRGd540YRRDfB526X9trLjcSc8AYbE0O56VCF-E4itW7PIwDltdZE_JAU2OJ4w3Ib4G_q1b-MmCxP1OjX3iFjdQfisTanlt0PWqqOynP1ti9dPfad8exy-L5H8QZPmgimYZubkWTa04_kRLROC0ZJZxincdeV4tmuBcZGJ3JegSkS87Krbld-U2zBexLwMTq5Xvu6aXepK2wSFqNCqhv_LELFruZ5xxNPpgUsWQQUDQwyJcOZWQUklj28Ml1KurQIKPFUk-JBuaRlvAG8BqDJTrvzvDBd8iM804CKD4tyMxFImEXKbrDMDk1mQ0vlNmThMW-OPmsSgXMFpg17CkXWO8_H99xvPWz02inEy6GF5CJrpXRH_DpG2wj_-0EOv_vuo5QCjIP2fCmdqQdh4pmCUDLIP0pDMMCYF-adjVHR-LNEY2iPsOgaAejYSn8YOUqKZj4Njkic9Y86gV0agDRsfphifFGkVXlG7uKT5rhDpokSgmLbBQVPyaCIOJoelvmBlopGJenapxmqx7TWtpbDx3hnJtewfryg6xd9zZjWepvpVmIiL8u9veyOX0e7WWLLYRR1lEJgBJsq8ZPlCIXG3BuVznyJiSX1GsRyF8JL3y9DyNke-cvRnCIzNDV-ZEg9b9wXQBlpPD3srTWAikJWBr1-nFtVO6VvuFZdCB9pKIhzc3WMo5XiVLsJ4YskKeDnh0UP7wljCRqHHGqOfphB8LRon

                                                                                                                                                                                                                                                C:\Users\user\Documents\QNCYCDFIJJ.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.963610946390298
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WivAxT0Njo5qlAr4I1/ci/r037LRMg1KE+RHq7BGEwVxa1wXcrFKg0EeuEvFjTsa:oT0Njo5qlyvFcJnRMRE+sFZ0xa1Cguj9
                                                                                                                                                                                                                                                MD5:FD491A331094123566C4CD3AC63307EA
                                                                                                                                                                                                                                                SHA1:B60805665B5752FA487F966FAAF135359D495ECE
                                                                                                                                                                                                                                                SHA-256:5521DD2DCE1FDC779114DF7AB507B44257A15CA98EE6D14D89D70B69C27ECE30
                                                                                                                                                                                                                                                SHA-512:7CA960F4E3F3EC0C335164CA7A300FF3DB0A32A9011916BC28EACD5998B3817B4D5BAEE3F63C66A146BD2ED88F809B6EE06A9EF44AD33F390B1AB15A9469C519
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ErrqOkAf1eUiirtNmqlQEfwGoW96AJdfBSAkTYlooS081wXCynxFicOdboz42TJ7ZYfT5y07nFbgqtZum0iJDCEApjin4_J4iuCHF6A9WZ_vTrGZOu_LEpYumqdEgFJ_qYJWBOqez3wy52KHwLTV2qQ7kptK2Kpz6_ivq3k0THLGhaHt7ma1yiBcw9wGcJSzPz-W4X0qWrZT2-JAW499EUGYuClyY6aisgTcmvRGcOTuDQ1Ab_a9YjCbEBivCTjFNiHmtgpPDzfX3Yo2mxlxRyJfxhkhCNj4Fth1OGDUcQTM5aP3r6rkvrivbMXNGUkupvon-mEfTZIuVrenqVTqfEO93J3mgONWz1IhAwmx5G9s_HCgOhnvoFX4RqVEGRJXf3szajV-oMumCZ5E63VXdW-4guLSrR5zpO88ypxYs9ogU32Kq0ONwZVL3-u2ivh_keXlo3f8yZyf_OrWJlvvvbU4zJPDZPAXWScHq80V1JCmG00V6m5QD8IUGlHA_8Vh92A8EURZLGftWQqwiBsGb7Fmo8NtK8rqGXOEkVs80_Id6tOFLxMMyjKLrbiV_miu6dRMdZ1pw35pktGFfU2WKNoGOomcErzXJf4T9JT5OX596z5e5aGnkaMGqdCXG_FT7wuBm7jNF7drUlVqHHEU52zLQlI5xiinC32hXn-MO8dgGo5igFMr73cqnYOmbuBmBndWuSwTscHj1Xpaw96yNhFWe8y2Vwg1A6r_gFeTU8e5b1fjcjheSbdnw7wl4_y413rT8AHRelaqRBy4FEEAyqfHXxFaQnA-2JQ-u4nLdF374R52Oj2k9mGVZYcAZoXd9XCtVfupf4UnLO6T3XKxBfDLVygl0a1PPm1qocoVsfrPLMxwg_vI4LB_uoefToIn1WuVfIvyQ1mpoA7d6LJ4FdCHMlfS8wt4sqpJZhOQeq-xj6f6Cb2hBF65-CseKbTncjw55e2I5ZYLN5vXJ7DVRui05Qy7N

                                                                                                                                                                                                                                                C:\Users\user\Documents\QNCYCDFIJJ\BNAGMGSPLO.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.957090167028435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WPWTqreJrwf7UfgPXT0pRKUITxPe8dWMEbFyu2SNcvypC7scjCdCUSMbkDwUTp:Tqre527XPXApQUILDUsjvyJMyI
                                                                                                                                                                                                                                                MD5:F5C8FF00BFECE5DE855D065C65A791C6
                                                                                                                                                                                                                                                SHA1:97926B577BE2F226815A80EAEB41D5D48CF59190
                                                                                                                                                                                                                                                SHA-256:50E33E7417B6280DB25666E4C4E70E59FE8E8F96AE260FB4152A209DF63AD416
                                                                                                                                                                                                                                                SHA-512:24E88C361667F0C4B7FB5C4D6F55DEB7DB9D55DBB754C58B76399E73C6F1E6749E6E860853D04FF9B9936D977994843DB81B1CE6E19004EDED857F09C2024A66
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EKAsfNYPXbIwJIgBF4uL3-8dOWs-13V9PaYRpOfELnhCmOHKMFV2xfHsOnUAeLkph6dXk8hru82aWomqxacSgORE5nixt3S-LIJA23a0IimfflR29ScYoTpH6SweovllB1cguaRJ_OLu0aF-J1VlNXXWOsaD4IWnIPAZVA9KNa-Rv973Lx3BlcX2KnO4wiNL-MNY9hEOQUAhegkPsGkkOthtDNkL7_3XwOJ1BZGWUutuutjKCAKWglbunFStXLgVfGEpkCeFrAbePowK-mC6KRpWeErFcxY-sLowVdZOZ2HKkxkFMwj-qwlWXycFfJCxSO73NfU1rHdggr8Bi12LOwwx02W4JZGiALlsY84Nq9EF0to73iOx-DNPujyLsmk2SaeVGElMZ2zsog-hfLQgiFVYJh0X3L21SDRxsTFrU299e2Xq6h1HHdgQyTgLDcpU3YbMwnXowvg-gTXR9aEF80Iu14Q0A7APw7DY7xb7TdjyCXCj6yrsPErc7Fo0U-YfxN7_5ht0DFwt0XIxdamHuc-6AtkrEplceBQmfRXCxPThNa05fciW_8l4KSfVRaRGUg8nqshoFgm-OiidQktm1qtvA-N7dGjtYBjgYE-F1yg8Xrfem6oB4jIyHFQnLsB9HzFIqszPYWnO-z8tnChDBtO3ISTBzS0ITHgvoEjJ6VECfXCevvVnKwh2UUb40cg4AI8ZrYQ1ExuhFA5FrgPFqU1oI_dtfdd7r2qFXP25kkz5FjtL_0AHkALBfUk4zNTIvu0vG0pZ0PvsbAchFLdWAPfjoiFRdBf7Nr4dUC9Q4UcT000K2hF6w10wdaizGRiKu6nUIKt24xZonIjtgDfIp09kRQ6cz11-Dnc17d5ER3JeeAx4CtlWSRc42SvCUoazgtcDNqHamNL9UVh1ZrnEE4RgwG3e1VOmsmmeNYHaMdT5FWezaX1BnRVadwY2qr9qay54fOZgmvjpxRZjnCbMxYUnJXQXs

                                                                                                                                                                                                                                                C:\Users\user\Documents\QNCYCDFIJJ\PIVFAGEAAV.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.971095899126623
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W7xk0eXCl7dGdqeQ8WETPbwnTuLBNG7ov0cVehYsCxMk1Bmu6FIl4:mxeawceXWUPbwaLOuCYPH7u
                                                                                                                                                                                                                                                MD5:A018E17D237CEC911B455DA0C58CB7B3
                                                                                                                                                                                                                                                SHA1:B341FE6C1EAFAEFBAE4FFD9E7163EBB0E86F173D
                                                                                                                                                                                                                                                SHA-256:7DF6E8CDB38483FD5828A84EFB2C95D88769270A84271431266B226A5002EDED
                                                                                                                                                                                                                                                SHA-512:B95C0518FFF0E8BBFA8A95E93F9048D7844D12B8DB75B95801D85258AB6D22703859C91439874D8A559F6536EF97B7A584D3B79891276ED445544B38FADD44F8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Eczbq3Ixqy2TGZD2IlbgsyMKnIKVXlXxVbRTsDdA5Ebb1RFrSDKHF8esCC3LEz72n_WuutaEZYVEa8Lkn7SJ9H_Ye4nFac4QkNcWmqBw9cRLMgsen92Yhzc83HxmvJOq374YbhrgUnzLZjrRmhzVVjbykddNoUa-p1PuXJD4DZ67tvuV3GVcFGiTyM6VY6O8xi2eZfRlU9Xx2fih2UCf2WdgECEa68deSYj_b6cws_e9uEm4V9DDI9tlzbcPt5Cgdw3D7fe_2nKvHfaPmgto4WdlPmtgvFtETIDuJPWXarTeeqXZZidUlNVYE6QLmh9dUrxyeKxa4FB5TkQTcP6-h2hEyzPEOoR0zVCYnu6nh1Ev5RyD3FKmD5tdzIH7c4N7ibWAm5cWGbeQj9ckyxPt6Tz84Ua2u5-43l9sBlROuXV5J31zeTva_5OK6ifEMA2cINJRScXJePiT-4L8cz-Wu4u_ZDw1AVxBiKnUyXmQPTI0FU07-83IQ2RaqoMHd6WBBh5RW5VlN5Jlr9o9wT5wqfnz26fDTHafiQeNmFPB5fRo7dP9e3wLtcGH_C1ttFPPBJOUgQr7k_BVYIgOxtaYyR_ixu6anCVTh6_3iHm51etvUYHieowBBikEJlKFrUZN8Oo7OQmQq7p1scmob1xAf19koMDuIOkxxAqMWuIwn3LKBzLI38diqCq10bUzTpXgYPHCS1UTSKD_VxMljLHLz-IjSzAhcRKeTA3UCz3aN2HiyTwOOsxz9ii3uFkxi96BuiAyvuwY_GRYYwBtNqCwYxClVe98-BPGiP3l4fWVZPslxfkAnyTfId5nhKHy3wBgS6bgDCXbo2KG3UyT1B4NbKw-H12u_Nel0Ighbshl6AvyvsQDGcRKPZoNA8ytz-9YxIbUjEtSyek58oXhxVW4QGvq5k1_FCmjhfrvtL9FXtTrU2DjggpI0sDsPYmwQY6r70C4SG9GxrIwOP0mc6wNVp6K0A0Yz

                                                                                                                                                                                                                                                C:\Users\user\Documents\QNCYCDFIJJ\PWCCAWLGRE.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.970122957782456
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WKP1VOy2utcqOHueXdxWJF6pd8mwzupFt2pff9kbikfpBG7wSY42J+JfaH:JP1RFOHuxKdHwzup+pHc/RwSSaH
                                                                                                                                                                                                                                                MD5:51E556A247B61C0E7446314A8DD4EB1A
                                                                                                                                                                                                                                                SHA1:0654A80478013BC9ED382C752835D5ACB055C43F
                                                                                                                                                                                                                                                SHA-256:A03304FACDD2B31081C7B2D997CDF8E138D3132FC8D968926AF86E8414900101
                                                                                                                                                                                                                                                SHA-512:445AE89C21FC41C2DF5BCBFAA30D843324B1D6830E69E3F1F0220AB2CF9316554ECAAA6B97C97717A87DC3041CC2155AA8AC2553A25D05AF323264EE837291F9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EDWAMWaBuuggAFcnSoMXFSpVo2NHBnUPqemimR7Grdw4qPgdk_gdBtNZE93wCZ26eAkJOlUcoesl3LNo1G_Qx2kvx2cMVpmH1T5G69Rlnx3q4qp3MPGEBNp49n1aMc1C-t2mqn5gDvmzAZ9hO0I0s4_jA1KksW0IVbQ1VBeO6Co5YEAfhQeqw1bNFh8O_bDhTIhz1jKsb3U4Kgnn_sDM1xdA1mIWctOwi52fx1JyANJTWmRmxjD1zkxvYXj97F-tAt_Ngg7XrV9h1Axj3Uirzp6ufMJehBxHAyfC8wZJhojeh2rFXdA5zyzr_TrALlqTumr3cMXf82vUvPbHaiLCLz-9sFLrosv19Weq5WoKWifcTMiDKWU2Yim5Ns8uGsEbIN7mwsIep3N9BhNR0VWlimCrHqU1aCgWsbD_53OBXR1eiBaLfNE6eqxEKVMPBLdTwWoLk-fJCK7tYaOiD8Q6eh6w0MglVknF4LTPpLXtfL9FL1HvwHjcP8bzfUj5OQ3Hjvsgif1-swVk_xN6svaa9WZSV93aoyuL3lIOlwf5E5KaX1HxVKJQonTUIZSRiJ8Z5teoULz_cD3itIMbAl6VoOCgFJHqHrpyh06mVvPdbOSr5CO96gxuFN1awHJj1idPEYr9EWDQHN2zyOpSp_YjNBLSxnIxki6UVwjykPIs6B1ybRhuuBHF014TXR8hcCV4nmhSV7v_RTUdauWYXf7U3p_moS1M0pbePiadrijzNHmK_b5TycJIMiSTdZ8BgHugIVPFVAasW_Wtmtgc9BObMXR1HDecEo9V04mozgUPoTZhYpiVMuvOopFGlhS4jSTOghk_PWSBGYpGQccH8LVOoOrgX96w-2sua9WIOQxEAQ_OEkO7vleC4yB3NsB7aG7IPsPUuYYrnVDgZyd90LCVcbvKNWX_vzeT1fiA6o-3ZmJczem955OxzK5-qVUHnj2uTLwtETNi99IbXvXV1KkQER3J3SC9j

                                                                                                                                                                                                                                                C:\Users\user\Documents\QNCYCDFIJJ\QCFWYSKMHA.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.975182630014743
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WysBY/GpwW9HyyiH4cOY9zpkW5rflmzVYNbvT3ae601o9cjfOdyo4AcNxUMjvMK1:uBhpwWtiH4C9zpXmWbvTqeLTpDxrLnxR
                                                                                                                                                                                                                                                MD5:E6DC8AC974FD47E3007572B2A67FC066
                                                                                                                                                                                                                                                SHA1:BC4E2A62D9D47022CB27F17E3E67CCFA8E90F80C
                                                                                                                                                                                                                                                SHA-256:CB7441831FCE6D05615C08A9881372CE2789208AB63CEEA5F060766B93941B81
                                                                                                                                                                                                                                                SHA-512:8D3132C3C40312B82971709EB28D63E57D10FE13ADAC0102186635F22955A77BFE8129C4E76C9AA01591F186A00CE9BB08A328CBCB57E2333BC52292E41A5B15
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Et-Rh3OK9e5r1XbfpjB-AFruleFWkHIHp7pA8ArrXBI2Rdb0vfEd15fJI9antdNsQSLUSJu8M0b4afmLhDYePGJAieGNadrXSGuHACexmENLP8cbGuEwVE0gWdFEB2ULtE1mlWnSSMgOGPOdOuoIQi4KtiejDhMQzisSCpbE5WZJL2YLF7xcjsQlDXMgSeiB-biWiwdOTr8WxrN5E0dlNE3Vd_ji153yYV_wkYAMjSlj45jKMsVuez2Nz1dj67pOOkqkvR8-POBrFRtKRJGctIWmcXbi9NOxZ5sPgWgQ-7PJPAOhJsjH5tVyN0NXOBUmw0FrLB9qu51fdSpk_o8audzdzhQ7XxWQnUax46qWWZLuYsb6qXd8FFRBzqbUvBbL5jYKHllxcKPYPoo-DnbgHjoxPswb7VmBGi8e4WT9uJ8A7ze_QnSZHHZcnHzHKLlWDKq90lrVuCHCNfZuQtQW5KRCQjHyB4E53KzLv3FVHeHzG7xX2G-RygmGfsfxFtPidMKe-WXYYsjOVLrF7o_BVVQKesf6Fw-j4NGBK7L0nVOSQBWlq9knN5yP0Ub7ZCumW31gqW-4Tf7vKQReM6528QKtViKRvOAfG-MgZMcyyF4k_dbShbRPzQnKtaJkqBMlM_3qF1EA_IK76czCazu2hgp4ABMmo-ibok4GOfi2q5f7dev30V9fpWnGg5tzwrn42zuvyJzyZUyoKACHktuiMiKPXx6wx5zQ6eS-zr3QunAAvtDLq2UyDiGD4weevWexf8p_Y1X_m83kmkfwovXJAAYAJWYvn6SJhjR3ei6XDC3_lgwRckALIkV-iXTIoCdi2vwEnCX2cHgb_kAnVfSQD0BcyMo_MRECs4Zy9-mp1u6gzWxJI0AejgoEQ_WZ6BpR7zp79tCZQR_y7m2UuM8K--TAZVJyRIZ2l5zOUaD8WOOt5yJc_XLhCD8HXLDxqyfxFel3GXCl4rma0iflgWGvBKVD3DAjq

                                                                                                                                                                                                                                                C:\Users\user\Documents\QNCYCDFIJJ\QNCYCDFIJJ.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.983469030524795
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W9E5Lda5GZpO68tpBjiwHF7sKmWBZxrsCMYCv1AgpeJFFLaf5o7OCpKfwSrlciBf:dlAnsKhXjMYp8W7ufitKD+iBHtDBxt
                                                                                                                                                                                                                                                MD5:3249406CEA6DAA76039C2BD38EDE498A
                                                                                                                                                                                                                                                SHA1:4673AB050221D731578AFE5824A25B4809D79A7F
                                                                                                                                                                                                                                                SHA-256:6C62E4141388344B8952D6BD26BB68D246427BDB0033376D671A0CBB8C3448EA
                                                                                                                                                                                                                                                SHA-512:A076A4FD0DBE6BAB7BCDD73A9B7F52404B53314DBEA7C10383848EA81172404522ADFAEC76ADFF61BDF03EF59E7F774DCD99A8278A883E11250840CBB03C1512
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E3nIfgNI7mHTN4rjtqocUzX0d5PhUDvbnm0knw8cvi49PQv8DrAfCMAef3xTYBzCQKNqgs_3cJ4tIMQV6UcIlyxeMQafOZIKmfE2grqEdsFCPrPv5ptSyhjLxux4cNyxDRYngVQIb_Vv2K-lepAwaa6z91q8y2lgatjYPuBce3pn4YnuTrRRYR8BwvGkvxv8R0pKfcT8HOU-17H2V-Mk9Zq8QTo0yzj9Aqm3v43bny7F0xGJPslVYwGEJQBdvJOCK4G6D8yFGU1NPV5-jZkTliY_QAFs7bHybEOHHKAzLHs4-rmV1ufcKiO5nUx7udHUy2whDtuzpOhkkGT74UclZeF6aeX69ooeaZZgEuD4qGEvqZ7JY7P-sQ-9wnC9YTIeuRa8UJvKSxJ6gF9GmjkqLZglwYhnHIrmsjC-GjQ2Q2v8O89y58QTcDGNC0F_lHKk8ILukMcgNW758l1rILScAP8jNM-18HPvTko79AKWbod_JeMKjMdRzdw-nGLh7EEShz7w2jio1iFX-K11XpbiaJefPpL8AbL5seVuNRFzvaVamKry-k4wDcYfWQOVTH-Z_nQtNofoVEDPu1GxX1kpz4Jzjuj7WVXuSxnnwy8ngCx6FB3NM3UQ9PVKIXLWIlc0jtI86yQb_W23rGegTDCjkYjiMesIxlILGg9k80OO-SN0Y0MlCB6e6oKLX5CNR1aX7kOnGMkmKwc0GPUqp1TQQ5YwNdqA2AlnN7I8LVqJgKvIAT_QoI5mN3O7dD6zicPeC-leVWEOOaBe0I9UdNAO-Miso6mfBOZIHgyWDJO4uaTidS9PxAceDNhciT1MK70tRHvedlOZtbYGFvEhO8K_xt9aLzlZiYqYgyCGwZdNORaDxIra99rENkwSetmsD6OL0C12I0HK9iDonlUHOHMiCI2sa3B7SulWeSu83PsrN1wcLRzbZ853LBznogJGz2reM1sWn6PMn-maSyWZtHVpSWOsti5SK

                                                                                                                                                                                                                                                C:\Users\user\Documents\QNCYCDFIJJ\SUAVTZKNFL.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.97392055072528
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Wk5c2KN3izbkcO4TZ2mhGDxoUJMG+gUUnDMw0E8K3VWzAv0cseNjiTyyPIZ8aDGs:BvXztO4TZ2mhGDxJ7+M/Kg0cbjiTyyW5
                                                                                                                                                                                                                                                MD5:E9D3B242C611E4C16A0AE9AC8AA0BE0D
                                                                                                                                                                                                                                                SHA1:2E5929345F284ACD3ABC7CE1C0A87B6C00F95D79
                                                                                                                                                                                                                                                SHA-256:807110DF949FFCED9D2E8C405974F34712561126D92DBC780038B3EB504AA8B3
                                                                                                                                                                                                                                                SHA-512:BF1CAC6A59BF3E615D96DF9774A30D7EBB569E6E0E4D777DDCBE29C732B81306E7852C37BFDFECF5B4341C4935F69B64F10CF1C52E5FAE9CE4DD698C255B6B6E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Eplmq5GFG3hrH9unRKKVBgtH8RzlE8pmFKr8ZySc3zsqBzSvM9KqIlkNRG_neBjZPxEHzWAj9UG41tagPTpqMll-mIgmHm-ssPNdhRRQUnYr_F0ttQ7OB_LlGHbej3dRghMeIXxfVVP8ntyANwzc2yQ6xE00YFPkitxIGGjRW-PVoYrWgwuro_RfeBh4--9IJ-mIVQZGde9T5Glo6jyw9oiXVDbDhM-Krl8IFBunDZadue9QAwvBAL7rp-MbqwYundr-qudNnVKO7m8rO7xK4OM4SPFn-nfbUoMrmanQw_Igk6y1Hf4Er5Wwi4Zp6ojX0Hb4sNokaDes3joAvmgl2_S20aI5KGjnq5T2cwK2uPzCHkR8BYw2y8ybQeS_Bx7W7j-Gt1_ZID0hoGOCgGoJtQgo81kA6rdGhKQVwTr3rvKVcTQPZILYjelbK3ucZuDvvZk-h2CMVpYiV6m2GglAdEs1gQK3jWfT1CiME30frAwfvkEVUTFt8X-RKVRqye6JT5WwLgjFPvSSYPm9EQdfn7fWi4j61cji1QJ2DSJhhPnM1aweCOTt5aK5QDo2s_h6eCYNIbsFolapx9Jh8lJgQ_3ARmmyO7GjqmoUWC1KcKupWpL6V9u84Xv1RsQ6IA8RM9h11ywcEnzEi0ZQOdDr8ohsWXNm-xCay8_F3P_s6cAZg8GIWn9lBJAHGEnpwcY3jzcsy8HYNGNBHD9FXHnw0_4qMBB6PNxeFRXFnahpP_34IhwkoyIrSbpyDF8BKtRM9fci-yYlQouRsJMmWGqniA9OCWrpAA0IYPgMlfLBCcDaaAkkFiPDKyC_Ksuy16efS834yp2yIZ-gSRp6iky10TEb83dqaXguO_TFC-8BNOBzfbKucCvicrNWr-gUq4VIPL0-4tff_s-_sj2xlSX4JmA-ZraJ2wTcs1MgD1hHOybF5bpicSkbecTDMPMwRM9prAsrFeN2z86nMiXrS7ohlAAWovDzw

                                                                                                                                                                                                                                                C:\Users\user\Documents\SUAVTZKNFL.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.967017397070429
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WfoCm6AQLHg/v4NXwMcJVEIiQEJJ+uRgg5l0V171s2VbOFNa+LtE/lLxTJbAihRy:22f/v4dwMc/E7h3Rgg5l0n1s2VKFNfLZ
                                                                                                                                                                                                                                                MD5:95950A60D97BB96567AF6676D9C5E578
                                                                                                                                                                                                                                                SHA1:1AA94F568CB737AB17E592A2E9DC9684556C48A8
                                                                                                                                                                                                                                                SHA-256:C06539941197F38BF6FB207A605D88BBB875D54BA658F6E0E29AB74AF7E86C6E
                                                                                                                                                                                                                                                SHA-512:EF08EBF9DC70939BFBF54B3E9075F4C8BFE5C662B549E74C9474B5264DA66E4475B73D0F75E02E9EB414B5A8C00DB36767F69AB03275B2E1F1E6A9504F34B93B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Ek-mH_HqhiGZMKj9znaMvfIrgroECHcPo6_G7cIPjfOmd8N0QL8zrfP_qFF0xVHo2h24FrGl_CQ5toGzignbfIEEZ0MH8iHSbmZMmPad-_sgRG3AohfjcZ2qux-m2XajD59hXTU_VuRHZwgp7aMbb9rvhYe9lD6M4BZSedyugtJyFapDMsk5MVmcteJ5wgUNuQ5cElrVGebOz287X9v5XvDkYUiF_WwaKPu5XNeVPeKGj1OlClthd-3qcyInDsi3VDrP0MGW-Z6AT1py54MsMCAm5_V_Vqzfkldc7kcOdHqQZ42FIs9uuVJsHkdelxqZsoHzcI4Dp_w3qJc4jl2Y_H0HG7sr5ixMAzU41rNyugi00RtFYL8fapNFv65vbbH3whE3ZGQ9cqlyYN-nHz5mcK94ZwaDBq6zG4i9QCLjq7ZpngnyM7efPHIS-uaOCZsK1EmVcfbYgtsxqyalSDIoXGFDdibgH2qHknKJfribXZQFYCQVmDinZO06nHn2ay55SqoCJoKdizIVOYUmnf-StoUF8-4DLXoh0psc8_H0WWBLmka25tipwRlapeLZotE5HUl4xQF5JHQR9Nu1Iyd0U4beSaHk0MysTCW9uprY9YhYSTPzlcv_n6usWlIzI85rfoogtai9y-iDRuqfDwJmyLx6kmbM00MaG4ECHPvUgY_kAGDGMvL2DhilKYOMcl8JPtKIuHQbWef-hzb4EVcj_WC-vd5Mz7CbFHW-mWC6Z8B0Mi1okIzTX48sqFqlxVyUCuBhWEK4H8fCEEqDG0LWm_6drdPZQShd1o1D4HAsJn0xwlzTFZ6xNAUvqn8e8ZQsH29hajf0-yLGN_BJPXfqNNh-zpdpzX0A1Ru-woBiKiFfFXnf8Qm8WaQ0_-Sqwn2aa6oi9VT0kAC7jz0RFGUE-SowpgF81b4eWFbOEaTT34UgK8wDCHzVmtxQDpXpvPJI3jCY3i4Ocln-D438zwiK2-YNZSj3r

                                                                                                                                                                                                                                                C:\Users\user\Documents\SUAVTZKNFL.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9774325527296375
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W7yylkUU9N5nnqhrsPJBn4IENfOlNWQ5s1ObRprmatxfbX8vDb89rfx631gPGI9O:Oyo6/SmJBn4h2TJ5s1SZmexDab89tGq8
                                                                                                                                                                                                                                                MD5:D6BB2BF8880C9CFDB33CDBD31056AEC3
                                                                                                                                                                                                                                                SHA1:E3DADD4204240D5D5DDB3E6F90EC3D1DFF6A9C90
                                                                                                                                                                                                                                                SHA-256:102F93721CF90E65136AD5238DAF482EEE25A31556BBAA09692979104BAF652A
                                                                                                                                                                                                                                                SHA-512:6413FE3264CCE8947495C146BD26298EEE7E6913B3F57B98599381E154C7DD3C85A27C20B375490955521369D879A474C05B3F5FA9FCF0CE749BD9D9A540F873
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EU9FbejKJ4nhjbhp1AeNGGPehzaZbwHSky7FPk0xNuA9Zp9uv67xxWI1GnQF_oky4-eBiPgu1R4btiB1mUqZzqlUWgnplJoMi3zQtCZU845cJ8jk4Pq16gSHqQBfZypsLLBSr_uA5ZBLHT-IkGIwi8DjLKcIkwU5R05W4zGxNINpjpim4vyHx7DRm4pfO7JDjUkW9XtBfAAFNXFCN0QFUH1IG_mRLTc4a-jN-uJARSFmT_rObcXMDtnJuhjYeciFXpf-jeluipdg2gdhnNPNkV-xnSPeKn_v0TtIzAqFiKbjIghBhjdVYa64LUeLWiJqJ-frDiKHLWXF11BDdB9ZQesQNCaD-a0HXR9MXNH8qzH3Eoawdz6yzNSAk-oRCVpFlw62wC43ZrljQYiZuEk3OQ38TtZIWKT4RHKO172-3NX35C5lfQqVnEq_tW-Xke2oqUEP306GL8O_nPi7ixnQCY2kP-2KMnVhsZ_FO7mCmqSvDwooNprWLfKcSHhGIneRB940EefO81EQZdrjOAMXefsPLUV8nkTOSsY4Wl4blZBssdR7x32m-Fd-y0h5r-YhgiyBaUGbxpWIIaH_uFTutOi0_kwTIgBq7wnfoKhI9Ci9vDa9lHofrv9d6ZaykZK9fL7WB76PgmKsXrCgYRyY9TE5F-oJ1yhVcdrR1saFwum1IPGc3nFjgyfffHFlcGccw0_ZI6OkbgHGP-5i-tRwjQvNg4kjwyvRlb5WsYzJdbBVNfhGmzhi8R_Le-a3fgkyEhHhJCS8RD5X9ddqmNiSvDTff-akdykLw2_-iaskC-QgwFCiBQJpR-_i1wA7a8iB6GF6_lNO2H8wAC-wrY5YNzej3S6ASB7hwl30JuF9Mwmsu_A5IK2cc8MZ0jUkSsOdSLdOuVAs6E2T4wzx0UeEEl7vsGzHUgucXq-_re85C75r1I70TeW2e5Cp2eYc4b03PUyoFaDGMUTpg2Mt-a9O9sD0nBtiY

                                                                                                                                                                                                                                                C:\Users\user\Downloads\BJZFPPWAPT.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.967761069353684
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WPQmk4JFzO4zlZ4yUujtUL+IWvf60qhyWiQdDQU8trPTwitdtOKySuNGPshOjfzc:lmv0c+GvfYh/XdDQU2PTB7ySuNGiXAo/
                                                                                                                                                                                                                                                MD5:53D0D705A051E5D1C379178CE360B97D
                                                                                                                                                                                                                                                SHA1:055AF7A1ED1F3A44BAFB8C1791DD29566F09DD56
                                                                                                                                                                                                                                                SHA-256:795BD70825A6AF6ED6C4C3887FAC46A9237E2516C1626904EE2647C61CF64003
                                                                                                                                                                                                                                                SHA-512:061797E8E537583A7FC193D3AE8AC75FCF7B2EA21727A25A6B5C38DD7D9FEC72C5A20D48E00DFC59C5471C22B4E3E8A513AF36BF5DE21B6B3CD8DAC6187E5C4E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Ely0ejEqMUtKgQ0zfu0uwEiXi3qdK5U1oZAPDIqWnFaJrAP-iFNvISU7u-HYd6_4LIe6SX4wJyvQjJR0coBZCSzVlDOfhq4V0McuUPbWFtmY8PbEz3JxZu1OAw5SGKK7SwuKdnY5wMac93yMbF9IAi1D_0odKA28B2zdoxsdcE6EH-CNsDYYiAo7GMDG1R8DI4sAk2X-02CPFSB8ILUvsUIj3U8vMwBOj9YNKBFARp-QqB47LHZT4jtNEhkoZTRolrL8K6cwg_UFUCrlSWU0pqzC65TwV4m2hcbEfSTxM_HzmngAt0fqdXIDNFMHfzzpmctUyOj0JiL8s4_sVMjIlX-MHpO75NLdR3M1lGS4pSLsuIp0-16XICZkb6y1Kzikl-_NfmkDlubnW8qhyfOo_gN3biM9KCnrivYix3Z05HDENsLrA2ijEZ3dpv_iP_qOjnPHIEBnOPNIRtzyS8ZjZTW0DIfOThU6QlOdi0JwP40FXGr4tOmmVpCRg-w3fyaZC5-eBXQs72irsFXXOGAmw7ph6UnpKDT1w3_FcrXQhsH7lOF_kiJCGJ7BuYDJFKOYHLvR5sdGHftOgNUGQ7VhpRHLkhZ7xwNFeWram80QjPFEzrBgsegRI9Cl3Ii1l7JGHsgyFNub0UoI76jX7dHEP75ZTFbSlGeRAYnq7P1u8IxgC57lNnrVInZ6VFLkUCLggIcwp9RXRiC_RbwBPmPY1UfDT6kvvRqvzAT17ctXpPpLwScdKfnUb75FvOqCsNiIdLWOeA47P74Up1PASu6zuxbJvXy4tB8x1c5Wqc_4mbNPMlJS_4aOJS7oYwnuZSJoHg8ZNcqf-8Dw70rbOrdlyU4QP5V6_eMOHE2try9vj3dVJutcyQviZQ-qWRBdP-T22sFsYEKQufKqdxRvUian_i6cTx1rP7tzsMcio7xabUUcaSRBzSwhXhvFMvJ-9J_UJ7sxa4_aqr7U3CvOl0egOowOb9OzP

                                                                                                                                                                                                                                                C:\Users\user\Downloads\BJZFPPWAPT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.96148209746668
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WnyOHIA97OJ1X2xtNg8+0EetMEAX4cIolFVxUdK02FMkIDMHQO1iCjmDAW2:Aykl9KStNg8qetMbXNlFVxUE/FMBkaDC
                                                                                                                                                                                                                                                MD5:3267C23B8459F014558B95396B2FCAE8
                                                                                                                                                                                                                                                SHA1:D129DA391EF1D5E3E1647160754598E28EA2C768
                                                                                                                                                                                                                                                SHA-256:283C1F10AB3BEA61F13C526C58498850816313AD669C6D1DEC42E29A3084DCF2
                                                                                                                                                                                                                                                SHA-512:11EDF2FB7EC73BA7811DE605D85A7D3FDB08B53F2985C192461201067394A13B7A999AB3AD387137CAE304FD6918A64EE148D0FE88959BD1AA7886769BF91112
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EnTXprxPHalv0Hei11v3nEOdvYYhBaDe9oBsmp69HhVhW8Y_2wi7wnqxNVjPPIFsHtlaJltpslfcM24WFG3e-YC3ai2cPkNFnTnfOc3M-Z-U37cvXy0PS5Ai00j2ybDQ42jNUlFPZ3Xsa4LVScBsCgyFspzt8VnUv45YYBe54d1EFli1NlfOnnNlePad5UN6CH7Q6NYvdTdgHzsxsYPjRyROHeKoOBqUhOTFLX2E4Q2XQjB0g-8cA7jDf4rY4-ldhLE-zXzGwAu7MNkKID2rhakl11r-AKPfNQgkq0MmHNPH2maP35ZrY3Xyf8Iy4uYeUSRWfSHKJ1Bucbd76vzJnOfDr-KnJ4RGzlYdX8UoAW-LrGu0mfi8J08gOzauGJHeX9bAOruVfjlgeqH1yBuBEgqqZ5ymVejZT089BkxNEffiHTRWbaDY6BugZmr5aJJcsM94rnA_zM8Hgb2DIdPm_KZnPyXehVp3EDN3Y0JhKXZmHGkkOUjIPqf6th8hIiqzgf4rwTTjp7Slg94hxTx8Y4MXUPY8HqGxAclqL9AGVeNg24izaIsBeqS80Q0rtVe4ILnicckOM10kGlxA_OhP3hUPUae7aASXEpCJHFNAQTXYujDu92bA6DS5MJrjBFndMbWv5tGtKtzYCpss3YRu1UZAN4aSMGs6BVNKs5CnbnNtu5RwDXzDW2l7CBT5Op4LenogwKOVg5H-NqdXW9gVsPQn9eqv6DBMvQmiPJMltLcME1aSpkSguJqBG-eAWZM9VJ0u48kwFeVTL9-E9ALxpzMM5ORktj2PRid7aKZevpRTYjJK54deDJVPFBVZV2sgECnM3_0lUBg-84-hDIt3rhajHjJ0MZ_axw1Y7pzHZ_8iG3hGMYKDCZ3Vm2DgMr6ggrr-35kI_zH-hzSngrA3b8tsY9dTXiFaf_SB73hYn0xKok31cY7DBmVwvpP1QQgiHeH0efWTNSZe1UPk5_SKN4GaM_JT8

                                                                                                                                                                                                                                                C:\Users\user\Downloads\BNAGMGSPLO.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.978916765328696
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WNcePbCVjlfJUN9/sUlNMAe2RZUVh/bAm3nZ0glP7davnL19pZSx50okn:UTCplfGqmUVJ0AnflEp0rsn
                                                                                                                                                                                                                                                MD5:D7046F3306FB4B382FF2A1CD05C7CABF
                                                                                                                                                                                                                                                SHA1:820BC7E7510E43C9963E68F71B0425B7F2D133CD
                                                                                                                                                                                                                                                SHA-256:7AF82BF61A4392A3E851886A079F3145FBDE6CB40B6D080B33865C24CDEC3646
                                                                                                                                                                                                                                                SHA-512:BA2DA30838E1093E94EEF89167E6B01B54E3C839E1C7C8475EB7E0910FEE738BFB8F0243C90B9FD1AC9541B9D02773AD371BC744D7DFA1FC5A004F755DCD0974
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7Ew_IhbBIcgUDiZUSlq0ddNpTxkPJp9RoMWjysEHsEAKRSpbNWdzO7EpQv9djcmqRMzU4HfkX1960mex0U1FkJYRzWEgNeZQv1IItmVlD3edWWbpGcf5qZLRVOshpOMGE5DJvAImvsoVu-C553WhmKt5AHnq_wvu9a2YLjYvpyIb5ohGlUQZFPxpZlpZaBplAQNLtZvuFYBg6lfZL18FDw3-pGvaeRHuum_o0DK1Mu_GO8FfthlM3v5o72sP_Sm8EHrTZEVxq61vq89x6p-0PAhWrEMY40ibcI1VCj9_N4WX3cHumU3f6-QSPFTLTCtrroMm0x7A3yJNyd9K59jAFqZqhYCZbsFlLmChJ_UhJtbFUw8dAbnNPa7gvSABSBs9t82ZsTA3USrw7m5mzkXpcWXnJwT-pPljSBGWoZfc2pHdcQElr8qt-ORr_antwz7dc_enYBfWVMAo90JePK5O8wB_lNS_jTjkPkuSOeJ8c_NL89OVcThywGAZZzedxIgHgbuaOw5anuAZDW5CxgpR_9o4QErVLkfScvdCHUPukHcMPE4D0spZuyQVet68VfYTGqrT1nmzXQDLuHiZtq5a2w1Mwz_YJbU8EVWM0AEOtra1MKwfmJwl2Bl97Kkoh3GCI1ZygLq_KvsXxY7zTxxC7AfGKq0NeDg6G7N-V7t3NlIaKEmvqk0MATlAISJzS8-JSnx5pAf1UumRdE1Phook3BZc620bfSANJRVjdCKqswtzFR7Wb6z4476u43OVyfsRpZnnA-kMxps-HSG7lgTyvDLfQ-xEcRReNdhI1F38kLV92DE4Rqjfr4Qssy2gEFrtF7V5g1r5pCgIb32DA3dGSIV-2Q0aZLoAkxCJSdFOQ8qpLvVeRg4-wm8vI4AlfeyL4JRt4dkHqEoVWXj4dMpq-phW5bEqzqY1zr4LAoByJXGM9_ODyKl_MkEtoZqLdVja4DedpRal1GyTFT8J8TMZK3ASbq5cCq

                                                                                                                                                                                                                                                C:\Users\user\Downloads\BNAGMGSPLO.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.96720597494179
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WHIgggZA98k1By9xxGlG4lL5RlNzBmVmt4Jjf54v7VyDqT3bwk/IRuDDceaCZ:UJZArByxxGTL5Fjt4qkW3bV/N
                                                                                                                                                                                                                                                MD5:9F0B4B348E8177426BF9B4FA93B0C623
                                                                                                                                                                                                                                                SHA1:3B30BA52D29C1F521CBCD734DC185627F93DA8A7
                                                                                                                                                                                                                                                SHA-256:AAC7E8976C9158D547675FA824F90A78C66D91C36F609220C585C286283D961C
                                                                                                                                                                                                                                                SHA-512:759C660C42359C470332D5B54EC5BBB66A36FDC5F1DD2417CBA62B40644C907ADE40FA1C7D02AF7FE341C2FE9D8D79EE0363B486AF86AE64E45C293006CBDA78
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EBunlNZheospp53tpGMBgo_ZAVmTtyahB7jR1G9POT4icnbXc-PbtYTNddplZCGSexPjmf3cdd9UpSMyaYHSDpu8xrOoN6MXvhuxeyPI9sm-Sayy_Pne6axS_NwK_jksFAhbn8hglFwaRSHRnFfG1hTD99zeuMxb6Be5ODlYmK_ZB9GZQMGhBuLVqvL-P3vLc9sFkpSTF32g2J6qkQ5g3ZiFlzpl5v328E-WbCoTPVB9JLFtC_eiDkJym9oMM1g_fahPvU6I-rOhZTUdB1qZsQNQrw_TRm68Ca6_SGH8FZM3NgAyg0FmzPjTHdbw107VDReNroLQBhsXUycC7pLBrOBYSMOVeNBswn4B8bui75ekx9ugPGYCAft5DPr_dEBSRyIHD-kMkohRhAbq8fu1TvOat8PsXqzbyd0vFaUZq-imPxl_yj9X2hq1EO7yd7vz8Do3ZUl3eGQBK-dLqDtDMggk6OElocdV4J6feaIxO0SeYXDYnXUaEMy6ZTEcuTZOM9FzvYl4PzBaDJhmi2Tedo_N1401OSoMFdOR3aYNkRhvykluk7Fc7cNWViIX11ps9BxBbJRbtpBM7yocl-nQoZeXCODqYy4rXwAYazv3iVxgVHnz-ujFOMomC467mE2sUrDFAjIJgeCYb5bme2iNDM3xf7wZs_EMNbl06bM8dOSdzJKkIC-GxOESyhMZRFOMBSOhXi-VnufvXKOGgO8JyKxbzmhQ3yabsYYHhr6BI1asjpw1fAgl3uuoQvfWBuAA4LratjtsT3OrrBf7S73hOaNtcaTwRFPWYfCgQS_RxXpT2OM5m1X4a7ekJ_v-wubrMh8vSojUgSWZUGiCDoXmjLgyZUS8wFAv6lmfhPWQe_T2YkvR-3rbbPyB_IMZsXD0wjrnUDwkuJnyXCfTksyXiDiQCewJQ8zV_ubm5kWTtciwNFH7453JLa5FmtMDSqK1Yhl2MoAz7APIU7er7F2w1P3PVI3K5

                                                                                                                                                                                                                                                C:\Users\user\Downloads\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.97593920402069
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WwxISjGoT6aM6+f9zeqUAtaMfi7f92QUK9/vrSIotGtAYZDN9yJKwyByVU:RxXqJaxOQoKd9otGyYlxzByVU
                                                                                                                                                                                                                                                MD5:9AB17507B9F00C12DA2FF9E45CABC93B
                                                                                                                                                                                                                                                SHA1:5DEBCC3D6D9F28F34FBEBF71226DBC715C64C88B
                                                                                                                                                                                                                                                SHA-256:B9D85923ADA426FEC2F0C3E019823697DAF0450C70913B201DBA17CDCDE11540
                                                                                                                                                                                                                                                SHA-512:015AE462EE71710E73F767C6725B29DBD263A3D4BDA9A6F86C27569121E2A67D51E3C7C91865AD82516030495D5514C3ECD66F5552AF824D6FDA1A65A560CA82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EgCGsfbOjrpQbjX-7a-qh1m0HLc5uh3m4pxR9hmTvwS_PitvOrki37S1zu8YY2pTya4MVE8aIghJfTL-72rfTWdhaTvNgpImmTt3F1t4YP6_Kr37vVgpL3Pgjaedo_614pKzcB64NRmGxWHuL4HiOx1pJ33iuGwY6h_tKDy1fd2vho1Mj3lyhZN16FBFuGjJNqFKgS1GHxIdZFn_OMC98APDCuw8Id5HwLM69Mm0weHAfN23L_5R5w8Cu7ILzrySI8duK7iJtn_XyOc0Gmlft1VmKcOoLrqrf6GvUz3qwUCaUgh3B0FaCOAO9Gq3V4N8NHEl_ZcHlTMcoOto7ref-qvsrzffU58wDB5xdvSbkHpuVjRH0fYru1xTQqWb5PjfAiItT48-Z1vrm8kT7dN3aw9wuPWsZiXp8WFwVZsh9UwFtcY1xq1oemYAJ8DvUlKa1qurEITL_dIs174J9V9SoM1FdSsZqtcluKVFt74X1zRSLfP1YHOnYsajryPm5PD7vU5dz0Hr_j7kV71bkocaClYDufoRwbeNAJsllwgh9rNAuOjKM1YXhq01vjwpvqIOBpAic_TS84YEDeys-OfQs_6NoJBUktQ5heTMFCttIyaFV4IxN1uAqH0EZs3AzyMGWgwkfw0Ptdu3yojyYN5pZx6Jo2M65_d1_d_6S7gHIz9-OvZxNenRQ591YdKPLiXb4eTkpaxcc-FNVbReYL9H_cemnLwpgbWQTBhGroNCEqqxTARe9Q7DeMZZsLThqXsTk7hwvldGb_w2Jjw4642n6cxDbC00jpWkEfDGayPD8Mx-2_qLv56l4cWr14TMFQ_vIMzEO8XoTmsvkwQDwYf7iq-KyAHZK0Bws0kNvQn24nI8ADL3lrrQbes9rFgfs-eLChPZIyYsXPPdc-HbOXiBTZCvk80YlyOjDJY22UELj5yZextVXq-oiRf8DSXPEjfw1dG84Ep4dylrZVONW-uBKNtrFO6hB

                                                                                                                                                                                                                                                C:\Users\user\Downloads\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.963009021002277
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WmOjFfuB0146l1hjj+p2vJtZLSROt4zclDjtbaL3yqnTLi4wdkFmSm7ONrDCMFjb:sfuB01B+gvJtLt6SDBmL3yqnTm4vVN6A
                                                                                                                                                                                                                                                MD5:AA30CE7D048AD66D27EC38B54B66A524
                                                                                                                                                                                                                                                SHA1:3C762B8DFF3103BCA9F005D4C332BB6A0F3F9168
                                                                                                                                                                                                                                                SHA-256:7E849C4D4AE7A88F0A8D1B8402340A7A15C069AC579C937C36023FD1BA83C916
                                                                                                                                                                                                                                                SHA-512:03F3AECB8688C3C1D9187E15E453D507F5418D086AB03F7EF7568E7D9F64407DF2E8E9F3E8337056718CD0527305E29240BDD2BE473F0FF6E0C076ACF2B14974
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E1o3zcYr1xJ7JCBlCyudHljfwdEldx544ZwiWv25W_EBeQeXNoRJfZPJNxxwPnVXnHG-TjZeIpKPvgGb-31fD7JiYmgfpokWNisjPUvFoSpZygVTYaJsAMwZd4g2m6IQ3Yl93VGPpzufq-U3jm4fL9GB-VWdNqW7BSdyYPhvVPZywV51JqU9yTudo7KX3GOx3gFcRyCfcPJL1zB2eTnHgGokpvSy6SKI7Decwh_FieuWZwjKjpl54zpz06Z2e4szPub32Xv2rq9dDrxWu4NYhUlk3VWOSa8dB2wO0IX1WTbj0ONJC-iLO5j3PFtbsw8969ZR4diD53oIJoY5JWwDbouq5g1t8YjYEbcbjor-Vt2V03qJKTUJugM_D4UIJSCXYzHT2VdQYfyC1p6z-fEQwEjPYjb9jLQiTKW1iznQbiQZumP6eynShDCPbTDtHhergNTmFUZ-I7VN3a7OczishXlkat9EZsPW5sg0Mdy2OmRcb6mjUV473-ANj5s6XRulyVpo0BjhSt4RDGEMlgFw0L1huv247rx7eRcSP4OKDpzjlktI13BXjSZdbxIM-WOfoWWw1tjswFITKKDP4gGLrKzfqt3hf4-VhlYa_LkRb8ND5V2-kzsCDb6J2P1vP2eG0C4NlfiKiNakOnsl4w-wTxBYvS4jYoJ7Q6PCj_S32n3774LrmUtxpgRHvijSyNScyNdyNIf2WFiVQZk-Dan0utGnoIM5fERZxbSH1VfrkY9ww-zN7YWlwxRtIOGimub9JvjbnXXmYFCqQZo9swETw_tLD7r-F0vIAfm81Mf8VRvPVrj2e80gJ-CeCtuH8iFUMRX_g8duGJVkLev3tOVZauLGVSrrYqwcH32wxWPTYcJ2kMhpbO8yWP_rEmrU57DM5KDvWtRdT0WBSj3OYnmIAq4ZckQgiTbL7pZtfNNv0T2aWZnKXNyEoWmubI4FnWGKgoy6oKcU7Hk80kGjscNI-k6fsuUhd

                                                                                                                                                                                                                                                C:\Users\user\Downloads\EFOYFBOLXA.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.978100505747916
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WuxTEqd2dgkU2+GDLUqKQ6P2N/MjFVW4kzaKmtXSxSH2KpRNVOIJcFcYwxpi+:BxIpgkU2hoqiNjv75WSH/pRNkVOYwxpp
                                                                                                                                                                                                                                                MD5:5B6E2871A89D71FAF9E9B4E68701B7F3
                                                                                                                                                                                                                                                SHA1:BF8CEAAC4AA75AC017C0F1040733F8220E31184A
                                                                                                                                                                                                                                                SHA-256:259FA3A7DF22512A6C6B3B0D1A759238F4DD5272F47A7E7AF522FCB8C5CF4283
                                                                                                                                                                                                                                                SHA-512:9B2D4C939008EFD6E4677095771D8CCD1B58FEDEBDADAD713FBE6AE803E86A9FB358A6E344492D5F151CCF20A10C7A67FECFA7C0ABB0D1FFFE2F2846BE0F1847
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EZwRnguwi9o9lrKe2y2ETgfrgV5UrBt6pn2Pq5X2d94P11eC0YVDRJZE2y6ekrs1dl7zBtsKa7WLcojnVfFZClZb0cHO1vTY0aDNPzP1S_oajc9dF2soSBPHy6TCojk44E6gFv36Ayn2D5n0R941lVG-ZgwOQVPMdJjiF8WOp2C5giA1G1oH5kZNK7cA26CzVWLSahE-ONhfmc1WOGdBNs3P8OmyHsqUgfQ2dMfofqLGgRl_hzdhoR8UDtXdc0lU0lT-DJZrtDl6vzQAHkcCjebPZOv_3sRBljJULEjo0uveZeJGPxy0Pr0hhySFvde4uHnmPKHo5acN2RC_yIoG_xD4WGAPiLwM9n5ePQqiosetY1BPJf1jboHKhg7dlMPKbmANy0duyaJ2YEca8F0C08RhcsAgRm0TX7IHpIWZdOquuyF4vuTNGQbAF1Rx_5GbSj_VcEttiYHJGtzVv3Evq16BTaui_gIk_kSHi6UI4lh1U3SzNK9Of_Mel0Ig-X-jTNSdRpI4__mVvcQm64S2xK9yunUKwY-T4CrTrOfkrdE65tQTuOVf129tvLs4aVYrEpon7FzcC10QseOx1ZzqhxvaOif68uUQl-Cb0MC66IEyFhTkLlbIr4uqTLyMYnWzoboBLG4vlMdmH58Bfc8BBa1VfoZwXIEH09KorblDiNwjG4aBrLpwk_bSUFkckbKHMfVI7_2u2xgqEGi2SRbOUL47qsmT3OYjuoPCq58au8H0paFOfID2kOG8I-ergMuRP_51hjvtIU2nT1L0sTkfL_0QLcRJh3qDS4JZPM6DU60n76yK7weZefEFQRezaQRaMEc1JOE6NlrAnJxZjMzx1mnnZotYigL_IilgufRoSPg4je03qn-fNtk08RwAEMd1kTw7MU11QyK779lHvyIsCy6oHh8kqVSbwsedGF0mwdA7_SQWQDWrvEnKihxAfpiVTYXqCcnT_UpLhDwPp_MXHRiq7ODHA

                                                                                                                                                                                                                                                C:\Users\user\Downloads\EOWRVPQCCS.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9815882370589515
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W5PCOFwqqKAtEJBc/SLIvdF1L4yZQw7LBD4Vc1WWOuoqwWEQc78gRmH9qqGC8K1d:DOFfqKAtkcyIvhLDZLLOVccWWnRsdq5I
                                                                                                                                                                                                                                                MD5:7556DEEA415E4847BA1E747400A1E1E9
                                                                                                                                                                                                                                                SHA1:3C4D1D0C3D299773B99A78A5889999740D9678D7
                                                                                                                                                                                                                                                SHA-256:8B127BF4C28A370FC3411CE2E102D9A63340B476719D8B199016706B37AF2278
                                                                                                                                                                                                                                                SHA-512:390968923AA5B7F6CE0C12135B61D8536D569D7810538DA1147643CD66AA6AE2CE9097E0F33DD98DB03207364C77674122315ABA8FE01F2D87B5799C2167EE8E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EKNEuzB8QcsohpN5xsww1JK33AUbLcfg5pO0uqk-xyB3LquRLsXh2l2Ve98CKQ4S1Wpn8bDDbSIf6UmwE-lOL_2_Wt59INAOpRuWZGBIYYgF8wmbiv5CPHwMoPa1DdwVqjY4wDDAHjC0BbKf4gz9QMy_P-MDyimW4kRHbl1Zku6PQ1FO7WoOKFvwO8D5NH87mEuy4p9TXbe1flqdhP2a1xERKB2-RvGfhgRAvjypC6Nwg1kAl7NhYYxNIz62HyDoT4UDLuXAD13ndOfJ0bdjp0n8fC42W1KPToEQ_7w4Xp_a_U50wAdloMT3B--HtYRIKXr0mQ6J4JfUfei5EPuqoO_Q_8-chB_wpeRo8hxGomMe0dLQ1sd1bwHotG7xm8O2Zg16D0Pz6Q0OquXL7Fji5oIFD9D9GwNdX3cinFRHCcJWUib3zGaBKzo-UvkO1YkPcw4yDkAOA2hUkcdc6rF93PTRKzWF3_RLD3EhbSJo1VWuGkaZ5RnMlPuhRWYSyyBHL4tb-kCt4VBX_PaM6zvUBciK1tg48H0Y-QK8RpKqadQ38_LKHvV4unB8EIqcsSZvJPfYM7LVMjQ0Bp8tA_FJkZUwQ6_3v2LnZ4qkTDuZXLaEHf7mFiXALpJvjubGEKgNHubJRBJbHkecmaA7A0ZgPmYjQofM9yAk0RLmfl6tnCkoXvVGpXG1tY9dfrpIc7Ic5F2AIejMGsI0xDGKwMP1axyY7Oa_YxF_I86medBshDOOiAm-E7_i1YxyK7BTFREQq3zqQbIpvLXR6brU4yeeArBP19si6KEMdfo3RWrX6CwoNGoDS-Gq3YIIAIQCKebpiDPzcYcDi8Gjo4iFmt-k96suVpURWisDIvjQK66eqtYMoYcelsji5IAV0YcdWANUBt6H0Q7iG8aMH2PFhg4690THLRKs5QljlteRyg7xpRWkqi-B8_sx5Y0OV_g9iWny4H2KNpYWdK1Pd8IlHuqjUWCJ2k3NA

                                                                                                                                                                                                                                                C:\Users\user\Downloads\EWZCVGNOWT.mp3

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.97349486090959
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W1gIgdFmXDnZ3LtcHpK6Viv1wXbX73zjLvMtskrECqELnc1lTG9mDE/aJ3Y3sXaJ:X3dMDZhcXsNsP3vAtskAPRTIm4/isQsh
                                                                                                                                                                                                                                                MD5:19EB6D011CB83538ACE755BE803770C4
                                                                                                                                                                                                                                                SHA1:9A8A85D877BC92C021D34D614A6A87EFA646443D
                                                                                                                                                                                                                                                SHA-256:072A4EB75DE86830C43CB3047D9FF2DA099467209D2B20DCB4DDF99FB5FD8744
                                                                                                                                                                                                                                                SHA-512:566B31BE2234241207A2CBB4AC1A28E4E5EC45C2F6C62D6140F78B3489F841A8FABE0BF79051E1CF28FFDA5E3F6C2B74F8DA8C5CF51D7C2226CD0A28D0D68C0F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7EUbkkxOQvZEec2acKAy0yndkG06akdv82DOwlpVhlycMRXNgO6mO4tLfwAT7QD_DON7c1rA_VLZ3diUrRdcwjUVpam9Q6gUYfIX4JATyJAycXs_njgChnsq7mK9NqL_67IxReKdpYn8Is3yGXqUNb3WCbFi-cJ7YkwMdAxA-SOPVUEtNWKq3NCDzQaqDYgdK7ThvvcOfwqQj0USBchNXtZUZWB77IQMu4daPQYAdXcKicksECPiCc28kQAxbBnzs5vVGPlBUpWsEC_QoTflwFjSojtt9Da3SWI_LkuGcH4AmYYVZ0O9kewMJSGXS-zzbdXVBrd-v05NL4PTP31tuvrhyFhgMp7p79_u7R4m6bgekng7LFA7JkGcjim8ywVjjYrzlA-PnyQRGCte9r6hk-nLt0aHPTBW-t-nSWF2Or20zfNDH4mFHmWrHpBIhzrYGsiBONmnZmZR1CK8c9J_75zZOd8ViHNpJZWnPcqmtZ27EyAqhCpZt2he29cUB2ixHKUfKS15AJ8ekZ7b4r7YME7vZT2JXDIwuEChniJYJYhFGSO-w0C9BjNZ3azA_qLmBMzkrMOHojWpK5ryrApfDwsQYwnPZLTtsz0v8DWAric-e0_h88IViURxbZrp0iElO2JYNtugnhUIPtBVHx92Nd-It-trlIphJxJT33MBFKCTXjOnk06t1i5D25PnJiCS0hnUL0vYuKe6bFfkEmO8jjMOQPhGu3fohN2VXIRk-SKjGqzmD3hB-xRrKyQEMZVw3OlKTPhm8ddrnFufp2hSlPluEEoCQXdLFH71ACegIuD-42zAK11hqG03pJ5IIenxxpKSR67-pY0M7vQ050SFtFKygaqRdxptowHScCxenwxxlIQO0b4k1V_r981u3wLsw7JACPL0dQD4lDdGcADYVyYwnDZg1RvdUjdeGgfT4d5maFg3c6LgpGSnzmyaMylFohnb2x1ew_GYtOQ76wGVCZyGWtkXYN

                                                                                                                                                                                                                                                C:\Users\user\Downloads\NVWZAPQSQL.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.980324617290435
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WW9FbMz6MnhwgG1J+gXNMZ7Q9yrgPlS7WQL0732rNOoP0nTwwSa41fzbsfbDC:B9Ry6/gmJ+GNsM99QeKRO1nUwS13sTu
                                                                                                                                                                                                                                                MD5:2B452867A79BF6E8E9819D9081AF38C1
                                                                                                                                                                                                                                                SHA1:CB3E8C5EEA0756E4B56B3590C5863DA1068C7B3C
                                                                                                                                                                                                                                                SHA-256:DF73DC2E8E1DF293D34067BBF5E052F57C06EF445D6D3A8C7CC1F2DCE30B6E02
                                                                                                                                                                                                                                                SHA-512:DF7157C6F043607D41C72EBA09751CA8C899BEA7028FC1F9C506DD55E34BAC68BDEDD7CFE3A98569CE31A945259AB6929645103D2393475AC0EC333BE0646BB4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E6K5ihvwAueXJFIm7NFZUxGmcrI0JaSouSHV0TS-hq-BySjH02IPrV5Aszh62Ylr9LV40zHT_iBo20bACvUc7KLC-hoZx3oie3i2ISVucIFXP8BmSioBdFCULfLGGNlDm0IYUNlMxuWFA84ZBm0xqeTdo3n2eplry7X7o8AXngrAEUZbriILC4lvHqYORwIDxkOygM9lL-XxJShejVFcLMJ-JvuvDk-yufaJAJ53b6dQRmv4N1QtchN67R-cu5qRzYvFpnmKSIIX8NxwCtMtHeuXJnE_cT8J01B9jAWQDOpJRDeWL0_v2mHaiyt6rsRpZipV6QnV2fOjAzPQD_4LrA2ER3OeZJIfudohQAcsBhjKSAuG25a8thC2mKOIYYiB8Jpo1JQczmP9cqyVRLp9aE4205HK_cXNn5YBDijp5QQfFlDrDlOFMq-VzfEMsg0KnXsyCuyH44b8UybHDnnJ_fuCJg8l3R3u_y-4YPVC7sKkkWmhCwvUyM3rcSTI23v0ZPdqJhv3Z-DqoZ7FGe6FGLpjn3QlNZjLoMEVW912OFYZl4MaDBw92gq6V_1EPn9htuNvqKqHCV7dGwP7Qw3scJc7z1gtlOVHgP_oPoeHsco1kWapbIu3xrIRwmqsKnZ3AFyilfwBJxrbevjWlKSpIGN6roM-xazn1x2C-cXCzTSoi7DfFeVPl-GjFkpasWZDCw2GA9hMnpvWGNkrl6lVSI02vWmRAD9DPyOhIkIFB-xGJQvz9NWsVKpwcs__9Pv0LvxmPdETFiI-qG1lGdEOJd0Nn8GHKL43lqlZuQKHpfcuWZqApOccUNFsz4EVTIom1nUq07w58WdOC4JuexEX2MHHBIeBn07ew2kaCzAzIkPgpvfTCln8DIHevUd6rpdbbTisYXa8h4Oqugq45IQuqssJrm5QjqkxoSphCOCmi9afTFEnT-l6Sgfp4BUSH8NvM0FkywftVMiA_I8gMW__P0AlSdTiD

                                                                                                                                                                                                                                                C:\Users\user\Downloads\PIVFAGEAAV.png

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.9741605069238135
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WcZsqssfgBxlt6sLV5BQ1FNt1ByxDnsQMouG6ExxjBvUZT21iaBQczVwq3ZhTwqF:LsQ4tZ5ST1ByRbjubEx5BAMiamirPTwG
                                                                                                                                                                                                                                                MD5:AAF49BD7B6F03C7119B66EEE817FC206
                                                                                                                                                                                                                                                SHA1:B9CF38410EDC90230914A4ECDE84F92C1C8EBD25
                                                                                                                                                                                                                                                SHA-256:4094DC587721F8B4A122A04DAFBDF595D53DAAAAC57089F127AAF1E2EF4B605B
                                                                                                                                                                                                                                                SHA-512:F3E3EA25043F2FB1F37D2B43A7306CFF960B33C6F15D0BF62D9AA6A4C24914592653F1485877EA60CB346B9291EF9E00DDA533706A1ACD6F4101C2563005270F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ERgA0evkORVBdpxCpnJuDYHot7-Mtb9QMhqjnD_-P89iHWHvjzVLsm00aWshEks_urvVYMiYcufQS9kZq75Vt3gmXZwqPXMZa9YLDRRpv54ftVT7zRXhzHLANxcfmZvALhEeApTpGqCsSv1-b9Z28A2p9KNlxxQv35HWEEVJfJ0ykOA3koSUJ9nIlMZxELXdgF5Y5jFPZT2ztCFvFazj0g_KvZISWewABkRwZYRgM6ofyhZzdF7-1X8SPknZVwlWOSvXGMJPKLVeQG1JexPtmUdXLekOiuDvTgqkRIU5Er5rF7EkAtOeCT4ZQkg5J_JOIirwZRXGsad935XwhRfda7UtCE9mo-0Bp70Im36AEIwnTPNJQOTtf9de_oEmHmhUGhMlZ1VIPx7U3WePmDswFGPA2LpWldl9G9jxQ_lkZs6xxE7y5e53Y6lgkXw1IkhEKM8jM_v3HLr_a3Z9UyA9EGush2bGcLm-9IjqIhEDViOD4Lq2oTEwbs7nKzVoLyfgugax-bS9YiDI_8ye8akz-QvQh4GoOt1iC-0MARsrMa9X696CCr4eSPpYTArGI79Zt4sX8nLjFjB8EWfPTvVchYoHNFpBRHc6rVh8H8i7SdQjcBmv1qTRt8VVOdzXNcT2hNFSzsF_u1Ufo19A1RvxzMy0dntrEACPyKjI3wKowpvStYAfI-RQrKyzZLAmxO26KbT1KEDOv7SAF94O2rI-d4f_DLS8i1QhlEln9tTGW6WkuNH9N85vHDrHYuRiCyDfaGTCyIfssAq7j8MEUdk5H26_VUznL-c88lGdUSq3dKfskrct3E3xzTnEutoMRIMe3g-rHoxRW6E1o4Pix28STxSTlsTqEFGjAjPfheVKKNKQmKApxJUkVCRMTbvN_pOzXCfUzaV_Qwl1-EgbNebHX3u367WxGpYTLpoykAdQPUhIu6-6hUeRFJiEX12yfySClDPp1xcVShsy_ds0IVcOs_HXNZ0Cy

                                                                                                                                                                                                                                                C:\Users\user\Downloads\PWCCAWLGRE.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.965184668438393
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:Wh7NfMW+aEMg8nP4MlUA1NvsFYSji1jm30tVYSorBKHagpRGOORrxpkSIzCiAaNw:O7VMWwMg8wMlyFNjmDVMrAagTGOORrPJ
                                                                                                                                                                                                                                                MD5:BD55E1BAE82E14C890178B8AE1D6095A
                                                                                                                                                                                                                                                SHA1:4A3B5F20E52A55214DCAD3FB80E80CBA04C8AEE6
                                                                                                                                                                                                                                                SHA-256:F6C7C9980131BAB6242ED9EA4CC30F93F0D9C3FE4EDF5FE7046C95BF24DA36DD
                                                                                                                                                                                                                                                SHA-512:441F246AE5BAA5200FA65DFC11535C358F9A208728B4F774B418D159D92D2633C6C00212F074F48A7179559FCEA12227C3EFD1B3246FEC4962BD39812A16E227
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E3R93bOIMPE0Npw94ShfQyVXh0sKKFeuuehpO9QQdPuJVLfENJhvHo478YE8nPHw1X9DNCFJ4ini2q9P7DhiiZ6jX9ktsCLUNXqSpr6eDUjopAeEUTMvUDhCUNpx7cvkjw8rQxLgBDBIIGHrU9SX4lbFPF_kG-bf3yu9iZzlU5mQelvXFQiDq3SaVTnoRl9z96vp6oxg_CzLy_cJAjYQiBj-K2jhXQbwEi2duTqpCG9Ix4I9TLbNEMBnVc4khpQa9Ij09pcuPvZUyybGYWq9VU3fgy6RTDp-2dl2OrtiK0UH_HO-4hY7JKz21KqyIBaMvPMpZ9JNJq4yjyE4gygk-GbetKFkp7i-2VWEDE7OjaRyJK_x01swieNtW9xd-4Dfub01oVWdBleN9jQHVQ3KWOmo3PTU8vPwJQJar7LJxWBQEEeWeYVszlM1NYtb1Nw97GV4KEuoh6279yCFU7yO3PSVCYD8IIU4ct4VT-_yu0B11D5Gx8i5V32zZneghkVRnbsuYhoId1wt5vsYd2dG_zoLasRtZFkQDDcpGIIbSTH78QB9wby7jTaxeazZk5wM8pe8NTBkVe9y9DogWNj5MVA5SRPcRtqZGT_U5RciSPBAJMiJLgcj6UoaBelOqnxinHpsxmKse9HYY3AbcCg4IqEnIyuQ7LX-isJsHGDQpyl0MDJhsY0-3TltnEbAzbT8uLpj8-lnPipUh1d2eaOCJY_80Jw15tABAsYnDdRPCJ_oZ7_66tag5nStWeujX9Bi218LP4xC4dpCLecJNKVJea-L-BvZBsM3qrUEKCIRx26RQb0B12Y4YsHjjOHPDnjWP6Vg8O3RijVcU8OUHnpmMy-7YPh-omXFsIdTRWQrrA-m_jMNp4-3WUUau3lfrs3jy_SoUQCrgrlLKa4aHOHu677g60FGh39ylv98XMKm0jgzk1OzTcKRg7vOrbzbzL0nk3I0st1lOQjOiBg4mT8McjexM149O

                                                                                                                                                                                                                                                C:\Users\user\Downloads\PWCCAWLGRE.pdf

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969916372083108
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WviZzFzoRGimqbO8zmh7miMWmf5NswD5YX/v54jdolHW1tp3VWXWgppQ:IyzSGi5pMm5WmBNj5YJ4jd5FFappQ
                                                                                                                                                                                                                                                MD5:12C20FB3F227324B5422A40DCC918EB7
                                                                                                                                                                                                                                                SHA1:A5FF376F0BA550444DC37C346D4A22EDBD2D16A5
                                                                                                                                                                                                                                                SHA-256:B1B3752177A8ECCE7029D9E6587FBCE9B752C01B8536FE5B251F0DB139CF0F4A
                                                                                                                                                                                                                                                SHA-512:060F770991DE964B5DACD0DD1A38787E387419C8C9527CAFBDF72D8C13D3C13EA473DB6A8EA532C8E95BCE73D47DEE1A6B6A2EEFDDDDBBCDBFB18B38E6FF401B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7E_mEV9sQ_NS0uNKZtl8MwEedq8pgaHlfq589n4Ud7mXhLlG6xmUGY-a1JMO0XxwLs_AOMytS1wDbii7t-Icc6X4kUCJrxMvk6CSjGGp0VXkAzmT49lxl3ppY5ngdnX75ta1F8k-hNYTEsLUopu5ySQI9DueJysduOrTtnmpKYA0hd1tXbIeL7VZgYjaQwPbWKAzr0OFR0GbVFJ58XHtApF2dIdysU_twXdAffGxBlEfnUQEnvZ58VE0Cjyx9cBLpExjG6kTGyP8juA-Wh46vebidElc0ZRNt1-qxOAMloI98LU0DFZW_3SQgUgrc5woeM5u0Wt2y14lAYT_3hQBBQ9RgiesylfrCq6YFBJpEwYG9F1T57C1ny77CpXnO7fazU9HB9DwMxTFePNnF03cE29iCtiXAxZmfTTgkh16Qob3KxQglSR8vF8oTPjHUlNzjF291ZvQvA4mA2kjs9F75ApIsJEv31aEC7iFTyNdyd1v_u7jMOW9qdIej1qobQQedL1_0Ol1AGxfJIRyQeeVezUs-rJnGO2HgrRip7yukDJEQkeWwi7K0LsecHxPilTdWXbZjWKy_EiQVDX4kBU1hj9-ariKUHa7l6ICoXKGUOWW1kc_wNvA8GznTr_XErClIAOR-6U_b_j152LeLPu9J8Vau8jqfT0P0AP_kNw3qTR7v3jGKyzpb7c0i4O4p1lFnX9Md37PheYW7afuPANlFkprjrpAtDPNK642E3Ri6ipnrq_WLpUyiBl2yMs3vi9Epa9asoQoAGV6eNl6C9LxL1ckk9jZY9U_8gzGeHcsdtVb21wL8JrqYvAu0npTmI10DkEYXgtNJJbG7Mf8r_xxJpH2jI3OhyL4ia3AboZ1NrvPFY7Vb1XsQFo6WXqjdj00qUIYWGyVqV8Jytor38WNBRct_8QCl0tebMBnFxH5hMk4THhVNslnAAIngqfssb-385JmZDY0WlQDdv0LM1Ry8l_YZC_NMv

                                                                                                                                                                                                                                                C:\Users\user\Downloads\QCFWYSKMHA.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.969053096945788
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W+oxveJ//NsBSAdIjurm7r1HAmCBA/trf5Fb13EATTMjS6uEojNlL:UvI/CxIHNgmRtrxz3EkYjBuEIlL
                                                                                                                                                                                                                                                MD5:D7D0F4E9270F112230CA83F0F7D2AA96
                                                                                                                                                                                                                                                SHA1:6273546EA5A70D098B0F725601422C3B53688682
                                                                                                                                                                                                                                                SHA-256:164E51E518DE1A39DAB9CC82A93CACA5DE392726210B749F00E122EE20F82091
                                                                                                                                                                                                                                                SHA-512:E0A5C2B2454521CA39258218D8811BC37C926EA00186673EB668E4AF6488B2E500EBF04431D2A7866262842E7D31F6919AE3E890D0D1EE453711DCFCBEEF37E3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7ElCo_5YlkXJ7tpud0gzx4mlJblMNgseLVM_Hn1DIdn1zBqwoabEqqZnesYFa7iT6yzoWN0aux2RPsakGuQI0xWRW_xrTHkAmYoMwn_XAPFxaEoJKXb33f77Dhy3pm2R6R0upgthMwR-C5371-1QCIVeEMvc-Qd-RLzJi5aukR3enBN7pAoS68NkWLOnDowE-2lHnP4LatPpi3CthOwfsYaYqizxuc5LKhGYe4o7XmCnW-pAJk4F7TBalvJfLtw5vAuRtXzmg--pqXqSqztS-JgAQ8pR0ivOgVvVbr96NFgcJLzAQiYQbq8xqx177WSR6i0GPJHHly27OgXfJbxWagW4w7uu9d7DwAyTar8LIpkdaGnPzuyx87r2GP8MdVqR8KakLtSfktzSjUiU0rx07gkvqfujdZjaJto_kXjf-XHoKfA2oC_4SgStw5ojgaaeedxrJkgr_6RKZQjm9PlVNAahX0R9HvvgL3TkG9Il_JwCFCMSsWjxdh5kPrNkm8LPtIIhscTZ4wS-WfF0qCs0WH3tnPznj6fDvJA_npvzJTkwJRw9gWnDqwILmJ8qtJ9WlrXkzw2S6vG_ZryF-WjVHfIg0FqlNHeqxIht94ON_t7H3UgzaPtTGOXFCT6nYuCp56XKJ2T_j4kXPn_hEPJo1OtqsszpqWsPuvhkPtNo3Ft0YcYFdlXPl18r0BFxuGGEDkAa0tndZ7XKdgdnp5Ouxr7BTHqLk13-hgIGr808FzQ59gXdZvPOTqLe-PU-cz2m1I5zl9NKM4UGqZPGP-LZ1hbqLviRL7C0sVuF1sUE9JJs1gru_KZKBvUBjhume0ndnkVKgbGSVxQKOm1hPk9RXiRs5XeKV2ugr-H-eRYwZ5sL-gRpBrnPDy2oM9h-udUtapRvS4dUuiaVk9mK-L9GNfpDmRCko0cM1wj9xeD7I8TOV6Je2zBy7IXiEhlyPPDMyvO08Wj9WLWVH5Y6F5yYJY8r63UbRM

                                                                                                                                                                                                                                                C:\Users\user\Downloads\QCFWYSKMHA.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.979520396281434
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WDMFzup7aa/V9FBpj1KKOkM93SfPjILB4V+mqMwjVTkuM5/Z+1FZg5H4FTm8WHUW:DcpNVpF1nOiEurqxwuAGFZg5H4RQHBj3
                                                                                                                                                                                                                                                MD5:7A0EB43B975E685FFE542144E51DB0AA
                                                                                                                                                                                                                                                SHA1:73A87664361C648B459E82AE81183F210F419965
                                                                                                                                                                                                                                                SHA-256:B3ED53F57DC3EC11EEE707F92553C5931915CDFAAD6C1F3B948447F84C050FCD
                                                                                                                                                                                                                                                SHA-512:6851B9E1A33581560C036A80C6F6431CA138648FB3ED14A92036EE158339A95E5ADDA7B2F6F8B38CE5D6F0EBAEA2415A375067C63729577CAC9DF1355888F6A0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7FV9Pj4MFp-SrpMXS1XO7otQJ-FiJc1HQRCJsNBlau6AF_XeNjZB1a_SY5PJHEqzy_F0_WI6HPsNLGKNIQPz4--W6VNSv3m6C_mmTKHwbmqGQEf35b2CACqOf16pCThLe5R-LU6zk4yqddCFc4NncVwVtLTHXCHAorfPXMEPtL-7CvUzLyBvpOU6lZWtuJyEhqxEw3v4SkVJF0JDljK4QNd1Pfh3nVhF-Kh3XvFMYFpMpeU_zgNN3Xe7yeKIYhTeVzEnY55VjXssKo1obZYZdEBjLJx16dTpiQLWLvsQZ-y2icP1YNKdA8NVsV2fX7PYGGiiDuR1289nBacZGWtR68WmXofthDbqoidEZRJv4FEdBXwXZ0wZzwXOa1oOUXId5ETlbuq_tOPu9cpsfuOHmyF9QReR54sdtS_wIV_XlAq-ld9O2BJDLfm3WGMLGNFeuQunLcNXRFko_ObNcD49RDDBiY8Y1SjdIVdG4lem4QmM3SXX_z5tL94ftlFh5izdQY7f4j2U9gKRMNrNog9yOixSLJz7IxM79mPUixK_iUoYq9WGFguM_mmsGdwm7jAIR0JjrxsKSVwx3IjA1J8C8qZe4SB-sxWs6ww_K5QXnSh1F30h3-6wPxhqdcWfvX1ao87TpUbzpQ1C3GNBAMjdb9rvWJVd_B9E-35pCzR2o4lQya7I7XVFm5uqiBi0nPdIxDWEGAN6PEE5cDDERljwxkV9OysuSo96R3rAJT9DEqaoq3YE016AzNHmWpo-NGTxxOuPsyOE4madznR5JMt3T7gQ6Chv5YzdDoVHr-RhROzioFhbvRWUIEdImeVYceCKTaoHJzoTslIMX5hSv4-XIeGSsyLlRoxVr_myklaBIkCOs9Z_vrtT5jFPc0WxUtjcgom8kjEiGGgfHuHNETEj_GsgAnPDX4XbGAaN4U7zlofS1QjeLfMtjycs-j39mz7IzLd7ave01Q8vH4yELv4znmCLIpOfSC

                                                                                                                                                                                                                                                C:\Users\user\Downloads\QNCYCDFIJJ.docx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.963904309032156
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:W1oQ3POwEn2P1Y+xsFbwPIJv/X/FPwMfOsLXxzGsk5z08WfRunKBW/dhQWQAYXLN:aOKUVvFPwMtLhnk53WpKdhVQAY3B
                                                                                                                                                                                                                                                MD5:BA77096E7192E4BEF2350F8077917E59
                                                                                                                                                                                                                                                SHA1:93B7EB8B7E4983811930ECE70D50B45B847D7487
                                                                                                                                                                                                                                                SHA-256:2B5667B19DBC69BAD9BA30CB1A7268140C77376D1ADB22EBAE70F5B3F58DB421
                                                                                                                                                                                                                                                SHA-512:25EE96ABCB138843F47927C7C9F49839C446BB0AE21B159179165893B1C200A2CFA40C416455CB9358EA471C99B9F72DF3F0BF39042543483858154199EBA74A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7FjPKv4PZQoSfolpM1DLwaKzVQer5Ss5Wv-mxMcbbNkiWqouthptoYSQaJmZjjOMJA4u71WqihhiK0Zsk41z7yHm3Tc8iPOzHIw9UgUZ2uBmj0LnBlq6BavxmB9j2nyMEuqJVFjVI6zudeQ255NoAIDRb-hkH_eDY9GpTJkQ9tsWtBDaKERyHQz2y1t_-sOAxbtyZf1ljQYGlY3vA7y_JRqbt2eW9brNlLx4Su58bO1ViPGAszGRRm49PBBeWloABaRKZ3YD2x-Y8BJUYwkePlBGpCJiPesMiLh1eOyoYYOZaslKnykCDEYy-v4GGYesdmUpjU8D-LTZBBDIBWYYmcP_q316JYA2fKanmkUPXSXG4YVEPmdSZwxp898TMlvCEaLI9ChlKiz_dZiGRwLqxNWAB1MZdYsFL-9YUETbCKTVSJbGy0VtmUo7DVwhrnoY7Q4-Yt_yyRJpXXSUc-U1rsaVsqUz6XHS5i_w7oyTpdf6FwdAYNqFuW8mDx2bzm6jN70xXabjkRnKcTChW_mpY9wI84nNVNZ4qJWajoqb6WEbQ-bR8An3WOgNa-dakzSl9q9A-ampZQSvKp5PbTaKoyRZpdzM-MjDW_nPPd-V3iqLQIMr3nEFBAQyQbTnit54QsjrH6fJYDPM0AtYLkdGrS31LriIJ59UjWwX5AYNdDAb9kEn6Q7qREIzpIUrE6ZSubCLpx39Ml2DpAKpCJZcKnSK9jfxzZe-ycUNbQf4KuhGlSfnppwpGP0tFC_06jPE7WWyK97EBm5Y-y3IQGc1qblX3-QNS0nTURHLyOiPTMeEYNwCkRh8FUjh0JUmwyL7Q-sM2EDCci2p-RQUzCGQwbHRpPnkkodDqAMcHsauE-O5ZSRbK80_HnHw733rsDDOaFvKPjSp_J4TvWKKtCCSTGpMcaCQ_RlCVuFeENrxVWXoHi29A3jSXXXs3-tyIv9UvV2pO_VnfPgY7j9T_RC6Y56yxI1SpV

                                                                                                                                                                                                                                                C:\Users\user\Downloads\SUAVTZKNFL.jpg

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.976059297519265
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WIZSyPu5C0OUvLnIDG3A2qi5iRCybiBOBpTAizxCB95p3kEEWZvXHO:dZ/ECzUvLIeqi5iR7iO+iFWrp3VVdHO
                                                                                                                                                                                                                                                MD5:899F369A926B4A5BDDF6A423BD2E8306
                                                                                                                                                                                                                                                SHA1:0E0F2D439C71FF8DB9E690543F2A3D21581830C1
                                                                                                                                                                                                                                                SHA-256:C3FB1FDE1077C6C051A5874084252A46345716C18E0721FE2A91258F6516583E
                                                                                                                                                                                                                                                SHA-512:00181D1D65E9D1EBE62330E875B6C7BF28FB60D5E64DD309FB4879DB85523F3DD0B77DD561B415CF5B93066357831120998FF862CCE31DC756611A37C3A871CD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7FCHCEcvBBtrQhu5P9Z6J4j-tPGrGWzk19SQqit41B5f8EXAM36CjZUV5HeKtS2Enc9_qGMvlOY5vT4VzdMsGNzy8gs10oRK_Jl_k4rQ1QhMO-gfuNRkeO_kGtSbgkiJ-NQCwaMpd4omPY6a-orvtWN8Jmg2_r7snUq8D371UHH7QeDr_gK6mh0ExRD_qgLntDo1aZ7rTshavuxI62k0iIfwGOPBkylqMpYcWRiPt4FE4AHgjDkF90O8y5yuLpg_i86NrBZeCQiEHxpbWvwml2NOwM3m-CRBtfjxqcwf8TiiW4Vb_b9tGSjGZhQIJ0Ypy_KwzQ_Itln80AhGd0tFsVTQ1r4htQcw3a2dZM-fMezJWl0riPx7esM2Luc8MiAlc3Hn-k0MlH6fJpbapfsB_9sxZL0xtbcuQKsUdpigOhMBP6yl6AI2WBkTNqazC0k970_H3v4zL_HYjIvrzFqWKwuh37krn4LTYisfQEK7z-yslwEN7NEkl_leWLsykp9OKSZV-991kGy9mWRbr-fuSvu9AknIjuf5IM0i5hZVMwefxsq97GvnFJ2eA9TAUVppOxwaVYOfwJ0DKGLNFk1XYHSi6ccr-oj1qVMJIwLL2BMrE34MgJ4f5Y6KdcoQ0Veck2Zldt-Be-1FimUZBJvXf4n7gpCFogj4Uc4rUFehQT9mDvy1Atu5q8eWpCGTUlss0yIQoWzCMl0gi_DXN4LsGg9e34GIP9CuCYO0yE51HfT1nBHHqiUYhq5k_FsxOPUWm4iQVdSIBSOUnD0N7L1t5e2c-jCGB-JZgFYViZAH7yBKS7cjJ3yKUZIApgqmVHDPwk9z4fj_9tS6dkojKNVNHEQXsHp2bNO-GORadsxTgQWgjg8FHi-fUUow3oRtrJFjdq7qiyMVI36_rucqUdrGEu805TVOVGLLVjaAtP1avpadOmkVnV6gYcVa4z_N4Ok95PraxBvS0lcIOS46-KjjnHp5DOUR2r

                                                                                                                                                                                                                                                C:\Users\user\Downloads\SUAVTZKNFL.xlsx

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1464), with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1464
                                                                                                                                                                                                                                                Entropy (8bit):5.972772472695648
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:WWSEW3po0+TF6jV1juGL+i3SE76UsOmP44y3q4mL+keT/ZfDCx:R+3poIjVxdL+o776+mPByxdfg
                                                                                                                                                                                                                                                MD5:28BAB30B4D52BEE703B8A8E9572E7526
                                                                                                                                                                                                                                                SHA1:771AD514BBEA030F613F3E5F0DEC5E040DDFD183
                                                                                                                                                                                                                                                SHA-256:CE1B0A7352408B3A496AF77284D7329E06937DB4BA3B7530493313167A1EDB16
                                                                                                                                                                                                                                                SHA-512:CC8CCCD373A8DB31FF654FAE6E895F0AED0BA8F26FBCDB125CCD8A198A115A53F8CFAC82488514D1D77728AF9439F5EF1681ED55FBA8767830CAC26C27A907CB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:gAAAAABnTC7FYztsBZisY494W4hlSohoGHsSZM7BGIvuMfM3Rt7IXL77tvOjmNeNrePsvKLkYW_FbIWy-1ztseiImxtLRpo5NW8rc7UPJOzvsbDmDexKrZ9GnxrHF8tGtvwi39YhLmawfN_GWldwsllU-PAR0Oi3n3JvWI2nqVIULdGBqU7Kf3-ZHTW8uwIvVMzXfofyfCQQBvp4nvZpMrUDFHGif5FCkxpDbJXKId63uZRselMt7Np4Nfkf5AQLJIcIA29V3hpAtmM2yZUj7o_M_NCiexgxHT9p5ASjbIFvJhi4qBqBwL2MSERsDUVcj7MtTiXzsvLz-zN6Sxqwos5KXndigFxfLUOyF_9NgL5S-c31Fz54nAi7CN8XctF233UQ_wN0Z5pmSTQRBBK6OWyjDQ8C1pA3pqoCwekRxfQ38o1v_1mjn-fiu-o4xW_CPtlzSKOjL9_pNk7_mrBymjLifOMAlwqdRaX5K106ObBkBsgf64uyg3KbyY4xZn12RlQEgYzXciRYNqmpoFtxY11hyGwE_xCApzlDv4nzZqaqyeQxq98LKt-JZKCyRHA8stsHHW4I8EOXCgtXlsuMhq2pcD7oi9sEooNzOJEFafD3xkJUqhgKQm3u6ukjqU9dM2qhIGyljGmuXZY8wvmS_2YXPJZ80_RspJcWbsofKiisDCszF9C_1DQD_QfsvHFr9Uu8iWTdLLGgpZBbDhDjSXfHM9DNKcrqhOr5__IcywOLG8p59Xn6bAaKaDzSYAmKMW3VlL9VHVCxx1YWzJtXYVtnvIzaNSwAqfjsZgu9FFfNrIas1Vpm5BPT6sHxX1wkstJXJbm_Y006sGn4J4SfkuPnj0SeNjl_Bt3kyAMLHgsfa3MoZFl15FWUlLpelHysSFSV-HRRrL3SZjSszUD1V-FE_8ism8GjN9QPWx_xcBWTi4MDP2tGU1C5OsOV6-kfoU2pJ14yEFN5jUvLsJNujH48BiH8YirvcWslfKd4

                                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Entropy (8bit):7.996257138735604
                                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                                • Win64 Executable GUI (202006/5) 77.37%
                                                                                                                                                                                                                                                • InstallShield setup (43055/19) 16.49%
                                                                                                                                                                                                                                                • Win64 Executable (generic) (12005/4) 4.60%
                                                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.77%
                                                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.77%
                                                                                                                                                                                                                                                File name:zed.exe
                                                                                                                                                                                                                                                File size:18'960'364 bytes
                                                                                                                                                                                                                                                MD5:faecb8128727e4d7b36e49b3161a2c9e
                                                                                                                                                                                                                                                SHA1:9a5d8f5d46aad666da03ab21f5b791c69522b279
                                                                                                                                                                                                                                                SHA256:e46cd48eecbb40507489635dd6323a2d2e1da717985f8894919860353f45f02b
                                                                                                                                                                                                                                                SHA512:cfb68942326ba2798741668c77fe2e06d4f7c0b8d3fd41687bf0cfb1ebbfc29156976b2a09572f87a2b54024784f5816dd00f240d85241e6e09238762e209af7
                                                                                                                                                                                                                                                SSDEEP:393216:59YiqGV2SW8077/hZ2YsHFUK2Jn1+TtIiF/ZxSWau504NsIyFzWYi3PzNuT:59YiljW80BZ2YwUlJn1QtI6YM50DIXPY
                                                                                                                                                                                                                                                TLSH:4E17338873E648E8D9DB663896E5835267E23C9667F0C18F57F816220E770C4EF39B11
                                                                                                                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

                                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                                Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Entrypoint:0x14000cdb0
                                                                                                                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                                                                                                                Digitally signed:false
                                                                                                                                                                                                                                                Imagebase:0x140000000
                                                                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                Time Stamp:0x672442DB [Fri Nov 1 02:54:19 2024 UTC]
                                                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                                                OS Version Major:6
                                                                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                                                                File Version Major:6
                                                                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                                                                Subsystem Version Major:6
                                                                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                                                                Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                                                call 00007EFD5C876E8Ch
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                                                jmp 00007EFD5C876AAFh
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                                                call 00007EFD5C877258h
                                                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                                                je 00007EFD5C876C53h
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                                jmp 00007EFD5C876C37h
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                cmp ecx, eax
                                                                                                                                                                                                                                                je 00007EFD5C876C46h
                                                                                                                                                                                                                                                xor eax, eax
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                cmpxchg dword ptr [0003577Ch], ecx
                                                                                                                                                                                                                                                jne 00007EFD5C876C20h
                                                                                                                                                                                                                                                xor al, al
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                                                ret
                                                                                                                                                                                                                                                mov al, 01h
                                                                                                                                                                                                                                                jmp 00007EFD5C876C29h
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                sub esp, 28h
                                                                                                                                                                                                                                                test ecx, ecx
                                                                                                                                                                                                                                                jne 00007EFD5C876C39h
                                                                                                                                                                                                                                                mov byte ptr [00035765h], 00000001h
                                                                                                                                                                                                                                                call 00007EFD5C876385h
                                                                                                                                                                                                                                                call 00007EFD5C877670h
                                                                                                                                                                                                                                                test al, al
                                                                                                                                                                                                                                                jne 00007EFD5C876C36h
                                                                                                                                                                                                                                                xor al, al
                                                                                                                                                                                                                                                jmp 00007EFD5C876C46h
                                                                                                                                                                                                                                                call 00007EFD5C88418Fh
                                                                                                                                                                                                                                                test al, al
                                                                                                                                                                                                                                                jne 00007EFD5C876C3Bh
                                                                                                                                                                                                                                                xor ecx, ecx
                                                                                                                                                                                                                                                call 00007EFD5C877680h
                                                                                                                                                                                                                                                jmp 00007EFD5C876C1Ch
                                                                                                                                                                                                                                                mov al, 01h
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                add esp, 28h
                                                                                                                                                                                                                                                ret
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                int3
                                                                                                                                                                                                                                                inc eax
                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                sub esp, 20h
                                                                                                                                                                                                                                                cmp byte ptr [0003572Ch], 00000000h
                                                                                                                                                                                                                                                mov ebx, ecx
                                                                                                                                                                                                                                                jne 00007EFD5C876C99h
                                                                                                                                                                                                                                                cmp ecx, 01h
                                                                                                                                                                                                                                                jnbe 00007EFD5C876C9Ch
                                                                                                                                                                                                                                                call 00007EFD5C8771CEh
                                                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                                                je 00007EFD5C876C5Ah
                                                                                                                                                                                                                                                test ebx, ebx
                                                                                                                                                                                                                                                jne 00007EFD5C876C56h
                                                                                                                                                                                                                                                dec eax
                                                                                                                                                                                                                                                lea ecx, dword ptr [00035716h]
                                                                                                                                                                                                                                                call 00007EFD5C883F82h

                                                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca5c0x78.rdata
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000xf41c.rsrc
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2250.pdata
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x570000x764.reloc
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                .text0x10000x29f000x2a0002a7ae207b6295492e9da088072661752False0.5514439174107143data6.487454925709845IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                .rdata0x2b0000x12a500x12c000c42c57233a0894dc80153254b9c2abfFalse0.5244661458333333data5.752665235006853IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                .pdata0x440000x22500x2400f5559f14427a02f0a5dbd0dd026cae54False0.470703125data5.291665041994019IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                .rsrc0x470000xf41c0xf600455788c285fcfdcb4008bc77e762818aFalse0.803099593495935data7.5549760623589695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                .reloc0x570000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                RT_ICON0x472080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                                                RT_ICON0x480b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                                                RT_ICON0x489580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                                                RT_ICON0x48ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                                                RT_ICON0x523ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                                                RT_ICON0x549940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                                                RT_ICON0x55a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                                                RT_GROUP_ICON0x55ea40x68data0.7019230769230769
                                                                                                                                                                                                                                                RT_MANIFEST0x55f0c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                                                USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                                COMCTL32.dll
                                                                                                                                                                                                                                                KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                                                ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                                GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.522362947 CET49723443192.168.2.10172.67.74.152
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.522404909 CET44349723172.67.74.152192.168.2.10
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.522469997 CET49723443192.168.2.10172.67.74.152
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.523253918 CET49723443192.168.2.10172.67.74.152
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.523267031 CET44349723172.67.74.152192.168.2.10
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.784231901 CET44349723172.67.74.152192.168.2.10
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.784925938 CET49723443192.168.2.10172.67.74.152
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.784950018 CET44349723172.67.74.152192.168.2.10
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.786318064 CET44349723172.67.74.152192.168.2.10
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.786489010 CET49723443192.168.2.10172.67.74.152
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.787940025 CET49723443192.168.2.10172.67.74.152
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.788091898 CET49723443192.168.2.10172.67.74.152
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.788093090 CET44349723172.67.74.152192.168.2.10
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:16.788155079 CET49723443192.168.2.10172.67.74.152

                                                                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.370584011 CET5227153192.168.2.101.1.1.1
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.510786057 CET53522711.1.1.1192.168.2.10

                                                                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.370584011 CET192.168.2.101.1.1.10xe5afStandard query (0)api.ipify.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.510786057 CET1.1.1.1192.168.2.100xe5afNo error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.510786057 CET1.1.1.1192.168.2.100xe5afNo error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                Dec 1, 2024 10:39:15.510786057 CET1.1.1.1192.168.2.100xe5afNo error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:6
                                                                                                                                                                                                                                                Start time:04:39:02
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\zed.exe"
                                                                                                                                                                                                                                                Imagebase:0x7ff6c6470000
                                                                                                                                                                                                                                                File size:18'960'364 bytes
                                                                                                                                                                                                                                                MD5 hash:FAECB8128727E4D7B36E49B3161A2C9E
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                                                                Start time:04:39:12
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\zed.exe"
                                                                                                                                                                                                                                                Imagebase:0x7ff6c6470000
                                                                                                                                                                                                                                                File size:18'960'364 bytes
                                                                                                                                                                                                                                                MD5 hash:FAECB8128727E4D7B36E49B3161A2C9E
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                                                Start time:04:39:19
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell -Command "Disable-ComputerRestore -Drive C:\\"
                                                                                                                                                                                                                                                Imagebase:0x7ff7b2bb0000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                                                Start time:04:39:19
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:14
                                                                                                                                                                                                                                                Start time:04:39:24
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell -Command "Enable-ComputerRestore -Drive C:\\"
                                                                                                                                                                                                                                                Imagebase:0x7ff7b2bb0000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                                                                Start time:04:39:24
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                                                                Start time:04:39:33
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\vssadmin.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:vssadmin delete shadows /for=C: /all /quiet
                                                                                                                                                                                                                                                Imagebase:0x7ff6024e0000
                                                                                                                                                                                                                                                File size:145'920 bytes
                                                                                                                                                                                                                                                MD5 hash:B58073DB8892B67A672906C9358020EC
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:19
                                                                                                                                                                                                                                                Start time:04:39:33
                                                                                                                                                                                                                                                Start date:01/12/2024
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                                  Execution Coverage:8.7%
                                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                  Signature Coverage:14.9%
                                                                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                                                                  Total number of Limit Nodes:33
                                                                                                                                                                                                                                                  execution_graph 19159 7ff6c6485410 19160 7ff6c648541b 19159->19160 19168 7ff6c648f2a4 19160->19168 19181 7ff6c64902d8 EnterCriticalSection 19168->19181 18849 7ff6c648f98c 18850 7ff6c648fb7e 18849->18850 18853 7ff6c648f9ce _isindst 18849->18853 18851 7ff6c6484f08 _get_daylight 11 API calls 18850->18851 18852 7ff6c648fb6e 18851->18852 18854 7ff6c647c550 _log10_special 8 API calls 18852->18854 18853->18850 18856 7ff6c648fa4e _isindst 18853->18856 18855 7ff6c648fb99 18854->18855 18870 7ff6c6496194 18856->18870 18861 7ff6c648fbaa 18862 7ff6c648a900 _isindst 17 API calls 18861->18862 18865 7ff6c648fbbe 18862->18865 18868 7ff6c648faab 18868->18852 18895 7ff6c64961d8 18868->18895 18871 7ff6c648fa6c 18870->18871 18872 7ff6c64961a3 18870->18872 18877 7ff6c6495598 18871->18877 18902 7ff6c64902d8 EnterCriticalSection 18872->18902 18878 7ff6c64955a1 18877->18878 18879 7ff6c648fa81 18877->18879 18880 7ff6c6484f08 _get_daylight 11 API calls 18878->18880 18879->18861 18883 7ff6c64955c8 18879->18883 18881 7ff6c64955a6 18880->18881 18882 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18881->18882 18882->18879 18884 7ff6c64955d1 18883->18884 18888 7ff6c648fa92 18883->18888 18885 7ff6c6484f08 _get_daylight 11 API calls 18884->18885 18886 7ff6c64955d6 18885->18886 18887 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18886->18887 18887->18888 18888->18861 18889 7ff6c64955f8 18888->18889 18890 7ff6c6495601 18889->18890 18891 7ff6c648faa3 18889->18891 18892 7ff6c6484f08 _get_daylight 11 API calls 18890->18892 18891->18861 18891->18868 18893 7ff6c6495606 18892->18893 18894 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18893->18894 18894->18891 18903 7ff6c64902d8 EnterCriticalSection 18895->18903 19191 7ff6c649adfe 19192 7ff6c649ae17 19191->19192 19193 7ff6c649ae0d 19191->19193 19195 7ff6c6490338 LeaveCriticalSection 19193->19195 19852 7ff6c64916b0 19863 7ff6c64973e4 19852->19863 19864 7ff6c64973f1 19863->19864 19865 7ff6c648a948 __free_lconv_mon 11 API calls 19864->19865 19866 7ff6c649740d 19864->19866 19865->19864 19867 7ff6c648a948 __free_lconv_mon 11 API calls 19866->19867 19868 7ff6c64916b9 19866->19868 19867->19866 19869 7ff6c64902d8 EnterCriticalSection 19868->19869 18731 7ff6c6485628 18732 7ff6c6485642 18731->18732 18733 7ff6c648565f 18731->18733 18734 7ff6c6484ee8 _fread_nolock 11 API calls 18732->18734 18733->18732 18735 7ff6c6485672 CreateFileW 18733->18735 18736 7ff6c6485647 18734->18736 18737 7ff6c64856dc 18735->18737 18738 7ff6c64856a6 18735->18738 18741 7ff6c6484f08 _get_daylight 11 API calls 18736->18741 18782 7ff6c6485c04 18737->18782 18756 7ff6c648577c GetFileType 18738->18756 18744 7ff6c648564f 18741->18744 18749 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18744->18749 18745 7ff6c64856bb CloseHandle 18750 7ff6c648565a 18745->18750 18746 7ff6c64856d1 CloseHandle 18746->18750 18747 7ff6c64856e5 18751 7ff6c6484e7c _fread_nolock 11 API calls 18747->18751 18748 7ff6c6485710 18803 7ff6c64859c4 18748->18803 18749->18750 18755 7ff6c64856ef 18751->18755 18755->18750 18757 7ff6c6485887 18756->18757 18761 7ff6c64857ca 18756->18761 18758 7ff6c64858b1 18757->18758 18759 7ff6c648588f 18757->18759 18765 7ff6c64858d4 PeekNamedPipe 18758->18765 18766 7ff6c6485872 18758->18766 18762 7ff6c6485893 18759->18762 18763 7ff6c64858a2 GetLastError 18759->18763 18760 7ff6c64857f6 GetFileInformationByHandle 18760->18763 18764 7ff6c648581f 18760->18764 18761->18760 18767 7ff6c6485b00 21 API calls 18761->18767 18768 7ff6c6484f08 _get_daylight 11 API calls 18762->18768 18770 7ff6c6484e7c _fread_nolock 11 API calls 18763->18770 18769 7ff6c64859c4 51 API calls 18764->18769 18765->18766 18773 7ff6c647c550 _log10_special 8 API calls 18766->18773 18771 7ff6c64857e4 18767->18771 18768->18766 18772 7ff6c648582a 18769->18772 18770->18766 18771->18760 18771->18766 18820 7ff6c6485924 18772->18820 18775 7ff6c64856b4 18773->18775 18775->18745 18775->18746 18777 7ff6c6485924 10 API calls 18778 7ff6c6485849 18777->18778 18779 7ff6c6485924 10 API calls 18778->18779 18780 7ff6c648585a 18779->18780 18780->18766 18781 7ff6c6484f08 _get_daylight 11 API calls 18780->18781 18781->18766 18783 7ff6c6485c3a 18782->18783 18784 7ff6c6485cd2 __vcrt_freefls 18783->18784 18785 7ff6c6484f08 _get_daylight 11 API calls 18783->18785 18786 7ff6c647c550 _log10_special 8 API calls 18784->18786 18787 7ff6c6485c4c 18785->18787 18788 7ff6c64856e1 18786->18788 18789 7ff6c6484f08 _get_daylight 11 API calls 18787->18789 18788->18747 18788->18748 18790 7ff6c6485c54 18789->18790 18791 7ff6c6487e08 45 API calls 18790->18791 18792 7ff6c6485c69 18791->18792 18793 7ff6c6485c7b 18792->18793 18794 7ff6c6485c71 18792->18794 18796 7ff6c6484f08 _get_daylight 11 API calls 18793->18796 18795 7ff6c6484f08 _get_daylight 11 API calls 18794->18795 18802 7ff6c6485c76 18795->18802 18797 7ff6c6485c80 18796->18797 18797->18784 18798 7ff6c6484f08 _get_daylight 11 API calls 18797->18798 18799 7ff6c6485c8a 18798->18799 18800 7ff6c6487e08 45 API calls 18799->18800 18800->18802 18801 7ff6c6485cc4 GetDriveTypeW 18801->18784 18802->18784 18802->18801 18805 7ff6c64859ec 18803->18805 18804 7ff6c648571d 18813 7ff6c6485b00 18804->18813 18805->18804 18827 7ff6c648f724 18805->18827 18807 7ff6c6485a80 18807->18804 18808 7ff6c648f724 51 API calls 18807->18808 18809 7ff6c6485a93 18808->18809 18809->18804 18810 7ff6c648f724 51 API calls 18809->18810 18811 7ff6c6485aa6 18810->18811 18811->18804 18812 7ff6c648f724 51 API calls 18811->18812 18812->18804 18814 7ff6c6485b1a 18813->18814 18815 7ff6c6485b51 18814->18815 18816 7ff6c6485b2a 18814->18816 18817 7ff6c648f5b8 21 API calls 18815->18817 18818 7ff6c6485b3a 18816->18818 18819 7ff6c6484e7c _fread_nolock 11 API calls 18816->18819 18817->18818 18818->18755 18819->18818 18821 7ff6c648594d FileTimeToSystemTime 18820->18821 18822 7ff6c6485940 18820->18822 18823 7ff6c6485961 SystemTimeToTzSpecificLocalTime 18821->18823 18824 7ff6c6485948 18821->18824 18822->18821 18822->18824 18823->18824 18825 7ff6c647c550 _log10_special 8 API calls 18824->18825 18826 7ff6c6485839 18825->18826 18826->18777 18828 7ff6c648f755 18827->18828 18829 7ff6c648f731 18827->18829 18832 7ff6c648f78f 18828->18832 18833 7ff6c648f7ae 18828->18833 18829->18828 18830 7ff6c648f736 18829->18830 18831 7ff6c6484f08 _get_daylight 11 API calls 18830->18831 18834 7ff6c648f73b 18831->18834 18835 7ff6c6484f08 _get_daylight 11 API calls 18832->18835 18836 7ff6c6484f4c 45 API calls 18833->18836 18837 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18834->18837 18838 7ff6c648f794 18835->18838 18843 7ff6c648f7bb 18836->18843 18839 7ff6c648f746 18837->18839 18840 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18838->18840 18839->18807 18841 7ff6c648f79f 18840->18841 18841->18807 18842 7ff6c64904dc 51 API calls 18842->18843 18843->18841 18843->18842 19210 7ff6c6497c20 19213 7ff6c64925f0 19210->19213 19214 7ff6c64925fd 19213->19214 19218 7ff6c6492642 19213->19218 19219 7ff6c648b224 19214->19219 19220 7ff6c648b250 FlsSetValue 19219->19220 19221 7ff6c648b235 FlsGetValue 19219->19221 19222 7ff6c648b242 19220->19222 19224 7ff6c648b25d 19220->19224 19221->19222 19223 7ff6c648b24a 19221->19223 19225 7ff6c648b248 19222->19225 19226 7ff6c648a504 __CxxCallCatchBlock 45 API calls 19222->19226 19223->19220 19227 7ff6c648eb98 _get_daylight 11 API calls 19224->19227 19239 7ff6c64922c4 19225->19239 19228 7ff6c648b2c5 19226->19228 19229 7ff6c648b26c 19227->19229 19230 7ff6c648b28a FlsSetValue 19229->19230 19231 7ff6c648b27a FlsSetValue 19229->19231 19233 7ff6c648b296 FlsSetValue 19230->19233 19234 7ff6c648b2a8 19230->19234 19232 7ff6c648b283 19231->19232 19235 7ff6c648a948 __free_lconv_mon 11 API calls 19232->19235 19233->19232 19236 7ff6c648aef4 _get_daylight 11 API calls 19234->19236 19235->19222 19237 7ff6c648b2b0 19236->19237 19238 7ff6c648a948 __free_lconv_mon 11 API calls 19237->19238 19238->19225 19262 7ff6c6492534 19239->19262 19241 7ff6c64922f9 19277 7ff6c6491fc4 19241->19277 19244 7ff6c648d5fc _fread_nolock 12 API calls 19245 7ff6c6492327 19244->19245 19246 7ff6c649232f 19245->19246 19248 7ff6c649233e 19245->19248 19247 7ff6c648a948 __free_lconv_mon 11 API calls 19246->19247 19260 7ff6c6492316 19247->19260 19248->19248 19284 7ff6c649266c 19248->19284 19251 7ff6c649243a 19252 7ff6c6484f08 _get_daylight 11 API calls 19251->19252 19253 7ff6c649243f 19252->19253 19255 7ff6c648a948 __free_lconv_mon 11 API calls 19253->19255 19254 7ff6c6492495 19261 7ff6c64924fc 19254->19261 19295 7ff6c6491df4 19254->19295 19255->19260 19256 7ff6c6492454 19256->19254 19258 7ff6c648a948 __free_lconv_mon 11 API calls 19256->19258 19257 7ff6c648a948 __free_lconv_mon 11 API calls 19257->19260 19258->19254 19260->19218 19261->19257 19263 7ff6c6492557 19262->19263 19264 7ff6c6492561 19263->19264 19310 7ff6c64902d8 EnterCriticalSection 19263->19310 19266 7ff6c64925d3 19264->19266 19268 7ff6c648a504 __CxxCallCatchBlock 45 API calls 19264->19268 19266->19241 19270 7ff6c64925eb 19268->19270 19272 7ff6c6492642 19270->19272 19274 7ff6c648b224 50 API calls 19270->19274 19272->19241 19275 7ff6c649262c 19274->19275 19276 7ff6c64922c4 65 API calls 19275->19276 19276->19272 19278 7ff6c6484f4c 45 API calls 19277->19278 19279 7ff6c6491fd8 19278->19279 19280 7ff6c6491fe4 GetOEMCP 19279->19280 19281 7ff6c6491ff6 19279->19281 19282 7ff6c649200b 19280->19282 19281->19282 19283 7ff6c6491ffb GetACP 19281->19283 19282->19244 19282->19260 19283->19282 19285 7ff6c6491fc4 47 API calls 19284->19285 19287 7ff6c6492699 19285->19287 19286 7ff6c64927ef 19288 7ff6c647c550 _log10_special 8 API calls 19286->19288 19287->19286 19289 7ff6c64926d6 IsValidCodePage 19287->19289 19294 7ff6c64926f0 __scrt_get_show_window_mode 19287->19294 19290 7ff6c6492431 19288->19290 19289->19286 19291 7ff6c64926e7 19289->19291 19290->19251 19290->19256 19292 7ff6c6492716 GetCPInfo 19291->19292 19291->19294 19292->19286 19292->19294 19311 7ff6c64920dc 19294->19311 19367 7ff6c64902d8 EnterCriticalSection 19295->19367 19312 7ff6c6492119 GetCPInfo 19311->19312 19313 7ff6c649220f 19311->19313 19312->19313 19319 7ff6c649212c 19312->19319 19314 7ff6c647c550 _log10_special 8 API calls 19313->19314 19316 7ff6c64922ae 19314->19316 19315 7ff6c6492e40 48 API calls 19317 7ff6c64921a3 19315->19317 19316->19286 19322 7ff6c6497b84 19317->19322 19319->19315 19321 7ff6c6497b84 54 API calls 19321->19313 19323 7ff6c6484f4c 45 API calls 19322->19323 19324 7ff6c6497ba9 19323->19324 19327 7ff6c6497850 19324->19327 19328 7ff6c6497891 19327->19328 19329 7ff6c648f8a0 _fread_nolock MultiByteToWideChar 19328->19329 19332 7ff6c64978db 19329->19332 19330 7ff6c6497b59 19331 7ff6c647c550 _log10_special 8 API calls 19330->19331 19333 7ff6c64921d6 19331->19333 19332->19330 19334 7ff6c648d5fc _fread_nolock 12 API calls 19332->19334 19335 7ff6c6497a11 19332->19335 19337 7ff6c6497913 19332->19337 19333->19321 19334->19337 19335->19330 19336 7ff6c648a948 __free_lconv_mon 11 API calls 19335->19336 19336->19330 19337->19335 19338 7ff6c648f8a0 _fread_nolock MultiByteToWideChar 19337->19338 19339 7ff6c6497986 19338->19339 19339->19335 19358 7ff6c648f0e4 19339->19358 19342 7ff6c64979d1 19342->19335 19345 7ff6c648f0e4 __crtLCMapStringW 6 API calls 19342->19345 19343 7ff6c6497a22 19344 7ff6c648d5fc _fread_nolock 12 API calls 19343->19344 19346 7ff6c6497af4 19343->19346 19348 7ff6c6497a40 19343->19348 19344->19348 19345->19335 19346->19335 19347 7ff6c648a948 __free_lconv_mon 11 API calls 19346->19347 19347->19335 19348->19335 19349 7ff6c648f0e4 __crtLCMapStringW 6 API calls 19348->19349 19350 7ff6c6497ac0 19349->19350 19350->19346 19351 7ff6c6497ae0 19350->19351 19352 7ff6c6497af6 19350->19352 19353 7ff6c64907e8 WideCharToMultiByte 19351->19353 19354 7ff6c64907e8 WideCharToMultiByte 19352->19354 19355 7ff6c6497aee 19353->19355 19354->19355 19355->19346 19356 7ff6c6497b0e 19355->19356 19356->19335 19357 7ff6c648a948 __free_lconv_mon 11 API calls 19356->19357 19357->19335 19359 7ff6c648ed10 __crtLCMapStringW 5 API calls 19358->19359 19360 7ff6c648f122 19359->19360 19361 7ff6c648f12a 19360->19361 19364 7ff6c648f1d0 19360->19364 19361->19335 19361->19342 19361->19343 19363 7ff6c648f193 LCMapStringW 19363->19361 19365 7ff6c648ed10 __crtLCMapStringW 5 API calls 19364->19365 19366 7ff6c648f1fe __crtLCMapStringW 19365->19366 19366->19363 20013 7ff6c648c520 20024 7ff6c64902d8 EnterCriticalSection 20013->20024 18966 7ff6c6489d50 18969 7ff6c6489ccc 18966->18969 18976 7ff6c64902d8 EnterCriticalSection 18969->18976 19376 7ff6c648afd0 19377 7ff6c648afea 19376->19377 19378 7ff6c648afd5 19376->19378 19382 7ff6c648aff0 19378->19382 19383 7ff6c648b03a 19382->19383 19384 7ff6c648b032 19382->19384 19386 7ff6c648a948 __free_lconv_mon 11 API calls 19383->19386 19385 7ff6c648a948 __free_lconv_mon 11 API calls 19384->19385 19385->19383 19387 7ff6c648b047 19386->19387 19388 7ff6c648a948 __free_lconv_mon 11 API calls 19387->19388 19389 7ff6c648b054 19388->19389 19390 7ff6c648a948 __free_lconv_mon 11 API calls 19389->19390 19391 7ff6c648b061 19390->19391 19392 7ff6c648a948 __free_lconv_mon 11 API calls 19391->19392 19393 7ff6c648b06e 19392->19393 19394 7ff6c648a948 __free_lconv_mon 11 API calls 19393->19394 19395 7ff6c648b07b 19394->19395 19396 7ff6c648a948 __free_lconv_mon 11 API calls 19395->19396 19397 7ff6c648b088 19396->19397 19398 7ff6c648a948 __free_lconv_mon 11 API calls 19397->19398 19399 7ff6c648b095 19398->19399 19400 7ff6c648a948 __free_lconv_mon 11 API calls 19399->19400 19401 7ff6c648b0a5 19400->19401 19402 7ff6c648a948 __free_lconv_mon 11 API calls 19401->19402 19403 7ff6c648b0b5 19402->19403 19408 7ff6c648ae94 19403->19408 19422 7ff6c64902d8 EnterCriticalSection 19408->19422 18977 7ff6c647cb50 18978 7ff6c647cb60 18977->18978 18994 7ff6c6489ba8 18978->18994 18980 7ff6c647cb6c 19000 7ff6c647ce48 18980->19000 18982 7ff6c647d12c 7 API calls 18984 7ff6c647cc05 18982->18984 18983 7ff6c647cb84 _RTC_Initialize 18992 7ff6c647cbd9 18983->18992 19005 7ff6c647cff8 18983->19005 18986 7ff6c647cb99 19008 7ff6c6489014 18986->19008 18992->18982 18993 7ff6c647cbf5 18992->18993 18995 7ff6c6489bb9 18994->18995 18996 7ff6c6489bc1 18995->18996 18997 7ff6c6484f08 _get_daylight 11 API calls 18995->18997 18996->18980 18998 7ff6c6489bd0 18997->18998 18999 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18998->18999 18999->18996 19001 7ff6c647ce59 19000->19001 19004 7ff6c647ce5e __scrt_acquire_startup_lock 19000->19004 19002 7ff6c647d12c 7 API calls 19001->19002 19001->19004 19003 7ff6c647ced2 19002->19003 19004->18983 19033 7ff6c647cfbc 19005->19033 19007 7ff6c647d001 19007->18986 19009 7ff6c647cba5 19008->19009 19010 7ff6c6489034 19008->19010 19009->18992 19032 7ff6c647d0cc InitializeSListHead 19009->19032 19011 7ff6c6489052 GetModuleFileNameW 19010->19011 19012 7ff6c648903c 19010->19012 19016 7ff6c648907d 19011->19016 19013 7ff6c6484f08 _get_daylight 11 API calls 19012->19013 19014 7ff6c6489041 19013->19014 19015 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 19014->19015 19015->19009 19048 7ff6c6488fb4 19016->19048 19019 7ff6c64890c5 19020 7ff6c6484f08 _get_daylight 11 API calls 19019->19020 19021 7ff6c64890ca 19020->19021 19022 7ff6c648a948 __free_lconv_mon 11 API calls 19021->19022 19022->19009 19023 7ff6c64890ff 19025 7ff6c648a948 __free_lconv_mon 11 API calls 19023->19025 19024 7ff6c64890dd 19024->19023 19026 7ff6c6489144 19024->19026 19027 7ff6c648912b 19024->19027 19025->19009 19030 7ff6c648a948 __free_lconv_mon 11 API calls 19026->19030 19028 7ff6c648a948 __free_lconv_mon 11 API calls 19027->19028 19029 7ff6c6489134 19028->19029 19031 7ff6c648a948 __free_lconv_mon 11 API calls 19029->19031 19030->19023 19031->19009 19034 7ff6c647cfd6 19033->19034 19036 7ff6c647cfcf 19033->19036 19037 7ff6c648a1ec 19034->19037 19036->19007 19040 7ff6c6489e28 19037->19040 19047 7ff6c64902d8 EnterCriticalSection 19040->19047 19049 7ff6c6489004 19048->19049 19050 7ff6c6488fcc 19048->19050 19049->19019 19049->19024 19050->19049 19051 7ff6c648eb98 _get_daylight 11 API calls 19050->19051 19052 7ff6c6488ffa 19051->19052 19053 7ff6c648a948 __free_lconv_mon 11 API calls 19052->19053 19053->19049 15923 7ff6c647cc3c 15944 7ff6c647ce0c 15923->15944 15926 7ff6c647cd88 16098 7ff6c647d12c IsProcessorFeaturePresent 15926->16098 15927 7ff6c647cc58 __scrt_acquire_startup_lock 15929 7ff6c647cd92 15927->15929 15934 7ff6c647cc76 __scrt_release_startup_lock 15927->15934 15930 7ff6c647d12c 7 API calls 15929->15930 15932 7ff6c647cd9d __CxxCallCatchBlock 15930->15932 15931 7ff6c647cc9b 15933 7ff6c647cd21 15950 7ff6c647d274 15933->15950 15934->15931 15934->15933 16087 7ff6c6489b2c 15934->16087 15936 7ff6c647cd26 15953 7ff6c6471000 15936->15953 15942 7ff6c647cd49 15942->15932 16094 7ff6c647cf90 15942->16094 15945 7ff6c647ce14 15944->15945 15946 7ff6c647ce20 __scrt_dllmain_crt_thread_attach 15945->15946 15947 7ff6c647cc50 15946->15947 15948 7ff6c647ce2d 15946->15948 15947->15926 15947->15927 15948->15947 16105 7ff6c647d888 15948->16105 16132 7ff6c649a4d0 15950->16132 15954 7ff6c6471009 15953->15954 16134 7ff6c6485484 15954->16134 15956 7ff6c64737fb 16141 7ff6c64736b0 15956->16141 15962 7ff6c647383c 16301 7ff6c6471c80 15962->16301 15963 7ff6c647391b 16310 7ff6c64745c0 15963->16310 15967 7ff6c647385b 16213 7ff6c6478830 15967->16213 15970 7ff6c647396a 16333 7ff6c6472710 15970->16333 15972 7ff6c647388e 15980 7ff6c64738bb __vcrt_freefls 15972->15980 16305 7ff6c64789a0 15972->16305 15974 7ff6c647395d 15975 7ff6c6473984 15974->15975 15976 7ff6c6473962 15974->15976 15978 7ff6c6471c80 49 API calls 15975->15978 16329 7ff6c648004c 15976->16329 15981 7ff6c64739a3 15978->15981 15982 7ff6c6478830 14 API calls 15980->15982 15989 7ff6c64738de __vcrt_freefls 15980->15989 15986 7ff6c6471950 115 API calls 15981->15986 15982->15989 15984 7ff6c6473a0b 15985 7ff6c64789a0 40 API calls 15984->15985 15987 7ff6c6473a17 15985->15987 15988 7ff6c64739ce 15986->15988 15990 7ff6c64789a0 40 API calls 15987->15990 15988->15967 15991 7ff6c64739de 15988->15991 15995 7ff6c647390e __vcrt_freefls 15989->15995 16344 7ff6c6478940 15989->16344 15992 7ff6c6473a23 15990->15992 15993 7ff6c6472710 54 API calls 15991->15993 15994 7ff6c64789a0 40 API calls 15992->15994 16001 7ff6c6473808 __vcrt_freefls 15993->16001 15994->15995 15996 7ff6c6478830 14 API calls 15995->15996 15997 7ff6c6473a3b 15996->15997 15998 7ff6c6473b2f 15997->15998 15999 7ff6c6473a60 __vcrt_freefls 15997->15999 16000 7ff6c6472710 54 API calls 15998->16000 16002 7ff6c6478940 40 API calls 15999->16002 16013 7ff6c6473aab 15999->16013 16000->16001 16351 7ff6c647c550 16001->16351 16002->16013 16003 7ff6c6478830 14 API calls 16004 7ff6c6473bf4 __vcrt_freefls 16003->16004 16005 7ff6c6473c46 16004->16005 16006 7ff6c6473d41 16004->16006 16007 7ff6c6473cd4 16005->16007 16008 7ff6c6473c50 16005->16008 16360 7ff6c64744e0 16006->16360 16011 7ff6c6478830 14 API calls 16007->16011 16226 7ff6c64790e0 16008->16226 16015 7ff6c6473ce0 16011->16015 16012 7ff6c6473d4f 16016 7ff6c6473d65 16012->16016 16017 7ff6c6473d71 16012->16017 16013->16003 16018 7ff6c6473c61 16015->16018 16021 7ff6c6473ced 16015->16021 16363 7ff6c6474630 16016->16363 16020 7ff6c6471c80 49 API calls 16017->16020 16024 7ff6c6472710 54 API calls 16018->16024 16030 7ff6c6473cc8 __vcrt_freefls 16020->16030 16025 7ff6c6471c80 49 API calls 16021->16025 16024->16001 16028 7ff6c6473d0b 16025->16028 16026 7ff6c6473dc4 16276 7ff6c6479390 16026->16276 16028->16030 16031 7ff6c6473d12 16028->16031 16029 7ff6c6473dd7 SetDllDirectoryW 16035 7ff6c6473e0a 16029->16035 16077 7ff6c6473e5a 16029->16077 16030->16026 16032 7ff6c6473da7 SetDllDirectoryW LoadLibraryExW 16030->16032 16034 7ff6c6472710 54 API calls 16031->16034 16032->16026 16034->16001 16037 7ff6c6478830 14 API calls 16035->16037 16036 7ff6c6474008 16039 7ff6c6474035 16036->16039 16040 7ff6c6474012 PostMessageW GetMessageW 16036->16040 16044 7ff6c6473e16 __vcrt_freefls 16037->16044 16038 7ff6c6473f1b 16281 7ff6c64733c0 16038->16281 16440 7ff6c6473360 16039->16440 16040->16039 16047 7ff6c6473ef2 16044->16047 16051 7ff6c6473e4e 16044->16051 16050 7ff6c6478940 40 API calls 16047->16050 16050->16077 16051->16077 16366 7ff6c6476dc0 16051->16366 16056 7ff6c6476fc0 FreeLibrary 16059 7ff6c647405b 16056->16059 16064 7ff6c6473e81 16067 7ff6c6473ea2 16064->16067 16078 7ff6c6473e85 16064->16078 16387 7ff6c6476e00 16064->16387 16067->16078 16406 7ff6c64771b0 16067->16406 16077->16036 16077->16038 16078->16077 16422 7ff6c6472a50 16078->16422 16088 7ff6c6489b43 16087->16088 16089 7ff6c6489b64 16087->16089 16088->15933 18682 7ff6c648a3d8 16089->18682 16092 7ff6c647d2b8 GetModuleHandleW 16093 7ff6c647d2c9 16092->16093 16093->15942 16096 7ff6c647cfa1 16094->16096 16095 7ff6c647cd60 16095->15931 16096->16095 16097 7ff6c647d888 7 API calls 16096->16097 16097->16095 16099 7ff6c647d152 _isindst __scrt_get_show_window_mode 16098->16099 16100 7ff6c647d171 RtlCaptureContext RtlLookupFunctionEntry 16099->16100 16101 7ff6c647d19a RtlVirtualUnwind 16100->16101 16102 7ff6c647d1d6 __scrt_get_show_window_mode 16100->16102 16101->16102 16103 7ff6c647d208 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16102->16103 16104 7ff6c647d256 _isindst 16103->16104 16104->15929 16106 7ff6c647d89a 16105->16106 16107 7ff6c647d890 16105->16107 16106->15947 16111 7ff6c647dc24 16107->16111 16112 7ff6c647dc33 16111->16112 16113 7ff6c647d895 16111->16113 16119 7ff6c647de60 16112->16119 16115 7ff6c647dc90 16113->16115 16116 7ff6c647dcbb 16115->16116 16117 7ff6c647dcbf 16116->16117 16118 7ff6c647dc9e DeleteCriticalSection 16116->16118 16117->16106 16118->16116 16123 7ff6c647dcc8 16119->16123 16124 7ff6c647ddb2 TlsFree 16123->16124 16130 7ff6c647dd0c __vcrt_FlsAlloc 16123->16130 16125 7ff6c647dd3a LoadLibraryExW 16127 7ff6c647dd5b GetLastError 16125->16127 16128 7ff6c647ddd9 16125->16128 16126 7ff6c647ddf9 GetProcAddress 16126->16124 16127->16130 16128->16126 16129 7ff6c647ddf0 FreeLibrary 16128->16129 16129->16126 16130->16124 16130->16125 16130->16126 16131 7ff6c647dd7d LoadLibraryExW 16130->16131 16131->16128 16131->16130 16133 7ff6c647d28b GetStartupInfoW 16132->16133 16133->15936 16136 7ff6c648f480 16134->16136 16135 7ff6c648f4d3 16453 7ff6c648a814 16135->16453 16136->16135 16138 7ff6c648f526 16136->16138 16463 7ff6c648f358 16138->16463 16140 7ff6c648f4fc 16140->15956 16570 7ff6c647c850 16141->16570 16144 7ff6c64736eb GetLastError 16577 7ff6c6472c50 16144->16577 16145 7ff6c6473710 16572 7ff6c6479280 FindFirstFileExW 16145->16572 16149 7ff6c647377d 16603 7ff6c6479440 16149->16603 16150 7ff6c6473723 16592 7ff6c6479300 CreateFileW 16150->16592 16152 7ff6c647c550 _log10_special 8 API calls 16154 7ff6c64737b5 16152->16154 16154->16001 16163 7ff6c6471950 16154->16163 16156 7ff6c6473706 16156->16152 16157 7ff6c647378b 16157->16156 16160 7ff6c6472810 49 API calls 16157->16160 16158 7ff6c647374c __vcrt_FlsAlloc 16158->16149 16159 7ff6c6473734 16595 7ff6c6472810 16159->16595 16160->16156 16164 7ff6c64745c0 108 API calls 16163->16164 16165 7ff6c6471985 16164->16165 16166 7ff6c6471c43 16165->16166 16168 7ff6c6477f90 83 API calls 16165->16168 16167 7ff6c647c550 _log10_special 8 API calls 16166->16167 16169 7ff6c6471c5e 16167->16169 16170 7ff6c64719cb 16168->16170 16169->15962 16169->15963 16212 7ff6c6471a03 16170->16212 17008 7ff6c64806d4 16170->17008 16172 7ff6c648004c 74 API calls 16172->16166 16173 7ff6c64719e5 16174 7ff6c6471a08 16173->16174 16175 7ff6c64719e9 16173->16175 17012 7ff6c648039c 16174->17012 16177 7ff6c6484f08 _get_daylight 11 API calls 16175->16177 16178 7ff6c64719ee 16177->16178 17015 7ff6c6472910 16178->17015 16181 7ff6c6471a26 16183 7ff6c6484f08 _get_daylight 11 API calls 16181->16183 16182 7ff6c6471a45 16186 7ff6c6471a5c 16182->16186 16187 7ff6c6471a7b 16182->16187 16184 7ff6c6471a2b 16183->16184 16185 7ff6c6472910 54 API calls 16184->16185 16185->16212 16189 7ff6c6484f08 _get_daylight 11 API calls 16186->16189 16188 7ff6c6471c80 49 API calls 16187->16188 16191 7ff6c6471a92 16188->16191 16190 7ff6c6471a61 16189->16190 16192 7ff6c6472910 54 API calls 16190->16192 16193 7ff6c6471c80 49 API calls 16191->16193 16192->16212 16194 7ff6c6471add 16193->16194 16195 7ff6c64806d4 73 API calls 16194->16195 16196 7ff6c6471b01 16195->16196 16197 7ff6c6471b16 16196->16197 16198 7ff6c6471b35 16196->16198 16200 7ff6c6484f08 _get_daylight 11 API calls 16197->16200 16199 7ff6c648039c _fread_nolock 53 API calls 16198->16199 16201 7ff6c6471b4a 16199->16201 16202 7ff6c6471b1b 16200->16202 16203 7ff6c6471b50 16201->16203 16204 7ff6c6471b6f 16201->16204 16205 7ff6c6472910 54 API calls 16202->16205 16206 7ff6c6484f08 _get_daylight 11 API calls 16203->16206 17030 7ff6c6480110 16204->17030 16205->16212 16208 7ff6c6471b55 16206->16208 16210 7ff6c6472910 54 API calls 16208->16210 16210->16212 16211 7ff6c6472710 54 API calls 16211->16212 16212->16172 16214 7ff6c647883a 16213->16214 16215 7ff6c6479390 2 API calls 16214->16215 16216 7ff6c6478859 GetEnvironmentVariableW 16215->16216 16217 7ff6c6478876 ExpandEnvironmentStringsW 16216->16217 16218 7ff6c64788c2 16216->16218 16217->16218 16219 7ff6c6478898 16217->16219 16220 7ff6c647c550 _log10_special 8 API calls 16218->16220 16221 7ff6c6479440 2 API calls 16219->16221 16222 7ff6c64788d4 16220->16222 16223 7ff6c64788aa 16221->16223 16222->15972 16224 7ff6c647c550 _log10_special 8 API calls 16223->16224 16225 7ff6c64788ba 16224->16225 16225->15972 16227 7ff6c64790f5 16226->16227 17248 7ff6c6478570 GetCurrentProcess OpenProcessToken 16227->17248 16230 7ff6c6478570 7 API calls 16231 7ff6c6479121 16230->16231 16232 7ff6c647913a 16231->16232 16233 7ff6c6479154 16231->16233 16234 7ff6c64726b0 48 API calls 16232->16234 16235 7ff6c64726b0 48 API calls 16233->16235 16236 7ff6c6479152 16234->16236 16237 7ff6c6479167 LocalFree LocalFree 16235->16237 16236->16237 16238 7ff6c6479183 16237->16238 16240 7ff6c647918f 16237->16240 17258 7ff6c6472b50 16238->17258 16241 7ff6c647c550 _log10_special 8 API calls 16240->16241 16242 7ff6c6473c55 16241->16242 16242->16018 16243 7ff6c6478660 16242->16243 16244 7ff6c6478678 16243->16244 16245 7ff6c647869c 16244->16245 16246 7ff6c64786fa GetTempPathW GetCurrentProcessId 16244->16246 16248 7ff6c6478830 14 API calls 16245->16248 17267 7ff6c64725c0 16246->17267 16249 7ff6c64786a8 16248->16249 17274 7ff6c64781d0 16249->17274 16254 7ff6c64786e8 __vcrt_freefls 16275 7ff6c64787d4 __vcrt_freefls 16254->16275 16255 7ff6c6478728 __vcrt_freefls 16261 7ff6c6478765 __vcrt_freefls 16255->16261 17271 7ff6c6488b68 16255->17271 16258 7ff6c64786ce __vcrt_freefls 16258->16246 16264 7ff6c64786dc 16258->16264 16267 7ff6c6479390 2 API calls 16261->16267 16261->16275 16262 7ff6c647c550 _log10_special 8 API calls 16263 7ff6c6473cbb 16262->16263 16263->16018 16263->16030 16266 7ff6c6472810 49 API calls 16264->16266 16266->16254 16268 7ff6c64787b1 16267->16268 16269 7ff6c64787e9 16268->16269 16270 7ff6c64787b6 16268->16270 16272 7ff6c6488238 38 API calls 16269->16272 16271 7ff6c6479390 2 API calls 16270->16271 16273 7ff6c64787c6 16271->16273 16272->16275 16274 7ff6c6488238 38 API calls 16273->16274 16274->16275 16275->16262 16277 7ff6c64793b2 MultiByteToWideChar 16276->16277 16278 7ff6c64793d6 16276->16278 16277->16278 16280 7ff6c64793ec __vcrt_freefls 16277->16280 16279 7ff6c64793f3 MultiByteToWideChar 16278->16279 16278->16280 16279->16280 16280->16029 16293 7ff6c64733ce __scrt_get_show_window_mode 16281->16293 16282 7ff6c647c550 _log10_special 8 API calls 16284 7ff6c6473664 16282->16284 16283 7ff6c64735c7 16283->16282 16284->16001 16300 7ff6c64790c0 LocalFree 16284->16300 16286 7ff6c6471c80 49 API calls 16286->16293 16287 7ff6c64735e2 16289 7ff6c6472710 54 API calls 16287->16289 16289->16283 16292 7ff6c64735c9 16295 7ff6c6472710 54 API calls 16292->16295 16293->16283 16293->16286 16293->16287 16293->16292 16294 7ff6c6472a50 54 API calls 16293->16294 16298 7ff6c64735d0 16293->16298 17563 7ff6c6474560 16293->17563 17569 7ff6c6477e20 16293->17569 17580 7ff6c6471600 16293->17580 17628 7ff6c6477120 16293->17628 17632 7ff6c6474190 16293->17632 17676 7ff6c6474450 16293->17676 16294->16293 16295->16283 16299 7ff6c6472710 54 API calls 16298->16299 16299->16283 16302 7ff6c6471ca5 16301->16302 16303 7ff6c6484984 49 API calls 16302->16303 16304 7ff6c6471cc8 16303->16304 16304->15967 16306 7ff6c6479390 2 API calls 16305->16306 16307 7ff6c64789b4 16306->16307 16308 7ff6c6488238 38 API calls 16307->16308 16309 7ff6c64789c6 __vcrt_freefls 16308->16309 16309->15980 16311 7ff6c64745cc 16310->16311 16312 7ff6c6479390 2 API calls 16311->16312 16313 7ff6c64745f4 16312->16313 16314 7ff6c6479390 2 API calls 16313->16314 16315 7ff6c6474607 16314->16315 17865 7ff6c6485f94 16315->17865 16318 7ff6c647c550 _log10_special 8 API calls 16319 7ff6c647392b 16318->16319 16319->15970 16320 7ff6c6477f90 16319->16320 16321 7ff6c6477fb4 16320->16321 16322 7ff6c647808b __vcrt_freefls 16321->16322 16323 7ff6c64806d4 73 API calls 16321->16323 16322->15974 16324 7ff6c6477fd0 16323->16324 16324->16322 18256 7ff6c64878c8 16324->18256 16326 7ff6c6477fe5 16326->16322 16327 7ff6c64806d4 73 API calls 16326->16327 16328 7ff6c648039c _fread_nolock 53 API calls 16326->16328 16327->16326 16328->16326 16330 7ff6c648007c 16329->16330 18271 7ff6c647fe28 16330->18271 16332 7ff6c6480095 16332->15970 16334 7ff6c647c850 16333->16334 16335 7ff6c6472734 GetCurrentProcessId 16334->16335 16336 7ff6c6471c80 49 API calls 16335->16336 16337 7ff6c6472787 16336->16337 16338 7ff6c6484984 49 API calls 16337->16338 16339 7ff6c64727cf 16338->16339 16340 7ff6c6472620 12 API calls 16339->16340 16341 7ff6c64727f1 16340->16341 16342 7ff6c647c550 _log10_special 8 API calls 16341->16342 16343 7ff6c6472801 16342->16343 16343->16001 16345 7ff6c6479390 2 API calls 16344->16345 16346 7ff6c647895c 16345->16346 16347 7ff6c6479390 2 API calls 16346->16347 16348 7ff6c647896c 16347->16348 16349 7ff6c6488238 38 API calls 16348->16349 16350 7ff6c647897a __vcrt_freefls 16349->16350 16350->15984 16352 7ff6c647c559 16351->16352 16353 7ff6c647c8e0 IsProcessorFeaturePresent 16352->16353 16354 7ff6c6473ca7 16352->16354 16355 7ff6c647c8f8 16353->16355 16354->16092 18282 7ff6c647cad8 RtlCaptureContext 16355->18282 16361 7ff6c6471c80 49 API calls 16360->16361 16362 7ff6c64744fd 16361->16362 16362->16012 16364 7ff6c6471c80 49 API calls 16363->16364 16365 7ff6c6474660 16364->16365 16365->16030 16367 7ff6c6476dd5 16366->16367 16368 7ff6c6473e6c 16367->16368 16369 7ff6c6484f08 _get_daylight 11 API calls 16367->16369 16372 7ff6c6477340 16368->16372 16370 7ff6c6476de2 16369->16370 16371 7ff6c6472910 54 API calls 16370->16371 16371->16368 18287 7ff6c6471470 16372->18287 16374 7ff6c6477368 16375 7ff6c64774b9 __vcrt_freefls 16374->16375 16376 7ff6c6474630 49 API calls 16374->16376 16375->16064 16377 7ff6c647738a 16376->16377 16378 7ff6c647738f 16377->16378 16379 7ff6c6474630 49 API calls 16377->16379 16380 7ff6c6472a50 54 API calls 16378->16380 16381 7ff6c64773ae 16379->16381 16380->16375 16381->16378 16382 7ff6c6474630 49 API calls 16381->16382 16383 7ff6c64773ca 16382->16383 16383->16378 16384 7ff6c64773d3 16383->16384 16385 7ff6c6472710 54 API calls 16384->16385 16386 7ff6c6477443 memcpy_s __vcrt_freefls 16384->16386 16385->16375 16386->16064 16397 7ff6c6476e1c 16387->16397 16388 7ff6c647c550 _log10_special 8 API calls 16390 7ff6c6476f51 16388->16390 16389 7ff6c6471840 45 API calls 16389->16397 16390->16067 16391 7ff6c6476faa 16393 7ff6c6472710 54 API calls 16391->16393 16392 7ff6c6471c80 49 API calls 16392->16397 16403 7ff6c6476f3f 16393->16403 16394 7ff6c6476f97 16395 7ff6c6472710 54 API calls 16394->16395 16395->16403 16396 7ff6c6474560 10 API calls 16396->16397 16397->16389 16397->16391 16397->16392 16397->16394 16397->16396 16398 7ff6c6477e20 52 API calls 16397->16398 16399 7ff6c6472a50 54 API calls 16397->16399 16400 7ff6c6476f84 16397->16400 16401 7ff6c6471600 118 API calls 16397->16401 16397->16403 16404 7ff6c6476f6d 16397->16404 16398->16397 16399->16397 16402 7ff6c6472710 54 API calls 16400->16402 16401->16397 16402->16403 16403->16388 16405 7ff6c6472710 54 API calls 16404->16405 16405->16403 18317 7ff6c6478e80 16406->18317 16408 7ff6c64771c9 16409 7ff6c6478e80 3 API calls 16408->16409 16410 7ff6c64771dc 16409->16410 16411 7ff6c647720f 16410->16411 16412 7ff6c64771f4 16410->16412 16423 7ff6c647c850 16422->16423 16424 7ff6c6472a74 GetCurrentProcessId 16423->16424 16425 7ff6c6471c80 49 API calls 16424->16425 16426 7ff6c6472ac7 16425->16426 16427 7ff6c6484984 49 API calls 16426->16427 16428 7ff6c6472b0f 16427->16428 16429 7ff6c6472620 12 API calls 16428->16429 16430 7ff6c6472b31 16429->16430 16431 7ff6c647c550 _log10_special 8 API calls 16430->16431 18393 7ff6c6476360 16440->18393 16443 7ff6c6473399 16449 7ff6c6473670 16443->16449 16445 7ff6c6473381 16445->16443 18461 7ff6c6476050 16445->18461 16447 7ff6c647338d 16447->16443 16450 7ff6c647367e 16449->16450 16451 7ff6c647368f 16450->16451 18681 7ff6c6478e60 FreeLibrary 16450->18681 16451->16056 16470 7ff6c648a55c 16453->16470 16458 7ff6c648a84f 16458->16140 16569 7ff6c648546c EnterCriticalSection 16463->16569 16471 7ff6c648a5b3 16470->16471 16472 7ff6c648a578 GetLastError 16470->16472 16471->16458 16476 7ff6c648a5c8 16471->16476 16473 7ff6c648a588 16472->16473 16483 7ff6c648b390 16473->16483 16477 7ff6c648a5e4 GetLastError SetLastError 16476->16477 16478 7ff6c648a5fc 16476->16478 16477->16478 16478->16458 16479 7ff6c648a900 IsProcessorFeaturePresent 16478->16479 16480 7ff6c648a913 16479->16480 16561 7ff6c648a614 16480->16561 16484 7ff6c648b3af FlsGetValue 16483->16484 16485 7ff6c648b3ca FlsSetValue 16483->16485 16486 7ff6c648b3c4 16484->16486 16488 7ff6c648a5a3 SetLastError 16484->16488 16487 7ff6c648b3d7 16485->16487 16485->16488 16486->16485 16500 7ff6c648eb98 16487->16500 16488->16471 16490 7ff6c648b3e6 16491 7ff6c648b404 FlsSetValue 16490->16491 16492 7ff6c648b3f4 FlsSetValue 16490->16492 16494 7ff6c648b410 FlsSetValue 16491->16494 16495 7ff6c648b422 16491->16495 16493 7ff6c648b3fd 16492->16493 16507 7ff6c648a948 16493->16507 16494->16493 16513 7ff6c648aef4 16495->16513 16505 7ff6c648eba9 _get_daylight 16500->16505 16501 7ff6c648ebfa 16521 7ff6c6484f08 16501->16521 16502 7ff6c648ebde HeapAlloc 16504 7ff6c648ebf8 16502->16504 16502->16505 16504->16490 16505->16501 16505->16502 16518 7ff6c6493590 16505->16518 16508 7ff6c648a97c 16507->16508 16509 7ff6c648a94d RtlFreeHeap 16507->16509 16508->16488 16509->16508 16510 7ff6c648a968 GetLastError 16509->16510 16511 7ff6c648a975 __free_lconv_mon 16510->16511 16512 7ff6c6484f08 _get_daylight 9 API calls 16511->16512 16512->16508 16547 7ff6c648adcc 16513->16547 16524 7ff6c64935d0 16518->16524 16530 7ff6c648b2c8 GetLastError 16521->16530 16523 7ff6c6484f11 16523->16504 16529 7ff6c64902d8 EnterCriticalSection 16524->16529 16531 7ff6c648b309 FlsSetValue 16530->16531 16536 7ff6c648b2ec 16530->16536 16532 7ff6c648b31b 16531->16532 16537 7ff6c648b2f9 16531->16537 16534 7ff6c648eb98 _get_daylight 5 API calls 16532->16534 16533 7ff6c648b375 SetLastError 16533->16523 16535 7ff6c648b32a 16534->16535 16538 7ff6c648b348 FlsSetValue 16535->16538 16539 7ff6c648b338 FlsSetValue 16535->16539 16536->16531 16536->16537 16537->16533 16541 7ff6c648b354 FlsSetValue 16538->16541 16542 7ff6c648b366 16538->16542 16540 7ff6c648b341 16539->16540 16543 7ff6c648a948 __free_lconv_mon 5 API calls 16540->16543 16541->16540 16544 7ff6c648aef4 _get_daylight 5 API calls 16542->16544 16543->16537 16545 7ff6c648b36e 16544->16545 16546 7ff6c648a948 __free_lconv_mon 5 API calls 16545->16546 16546->16533 16559 7ff6c64902d8 EnterCriticalSection 16547->16559 16562 7ff6c648a64e _isindst __scrt_get_show_window_mode 16561->16562 16563 7ff6c648a676 RtlCaptureContext RtlLookupFunctionEntry 16562->16563 16564 7ff6c648a6b0 RtlVirtualUnwind 16563->16564 16565 7ff6c648a6e6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16563->16565 16564->16565 16566 7ff6c648a738 _isindst 16565->16566 16567 7ff6c647c550 _log10_special 8 API calls 16566->16567 16568 7ff6c648a757 GetCurrentProcess TerminateProcess 16567->16568 16571 7ff6c64736bc GetModuleFileNameW 16570->16571 16571->16144 16571->16145 16573 7ff6c64792d2 16572->16573 16574 7ff6c64792bf FindClose 16572->16574 16575 7ff6c647c550 _log10_special 8 API calls 16573->16575 16574->16573 16576 7ff6c647371a 16575->16576 16576->16149 16576->16150 16578 7ff6c647c850 16577->16578 16579 7ff6c6472c70 GetCurrentProcessId 16578->16579 16608 7ff6c64726b0 16579->16608 16581 7ff6c6472cb9 16612 7ff6c6484bd8 16581->16612 16584 7ff6c64726b0 48 API calls 16585 7ff6c6472d34 FormatMessageW 16584->16585 16587 7ff6c6472d6d 16585->16587 16588 7ff6c6472d7f MessageBoxW 16585->16588 16589 7ff6c64726b0 48 API calls 16587->16589 16590 7ff6c647c550 _log10_special 8 API calls 16588->16590 16589->16588 16591 7ff6c6472daf 16590->16591 16591->16156 16593 7ff6c6473730 16592->16593 16594 7ff6c6479340 GetFinalPathNameByHandleW CloseHandle 16592->16594 16593->16158 16593->16159 16594->16593 16596 7ff6c6472834 16595->16596 16597 7ff6c64726b0 48 API calls 16596->16597 16598 7ff6c6472887 16597->16598 16599 7ff6c6484bd8 48 API calls 16598->16599 16600 7ff6c64728d0 MessageBoxW 16599->16600 16601 7ff6c647c550 _log10_special 8 API calls 16600->16601 16602 7ff6c6472900 16601->16602 16602->16156 16604 7ff6c647946a WideCharToMultiByte 16603->16604 16605 7ff6c6479495 16603->16605 16604->16605 16607 7ff6c64794ab __vcrt_freefls 16604->16607 16606 7ff6c64794b2 WideCharToMultiByte 16605->16606 16605->16607 16606->16607 16607->16157 16609 7ff6c64726d5 16608->16609 16610 7ff6c6484bd8 48 API calls 16609->16610 16611 7ff6c64726f8 16610->16611 16611->16581 16616 7ff6c6484c32 16612->16616 16613 7ff6c6484c57 16614 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16613->16614 16618 7ff6c6484c81 16614->16618 16615 7ff6c6484c93 16630 7ff6c6482f90 16615->16630 16616->16613 16616->16615 16620 7ff6c647c550 _log10_special 8 API calls 16618->16620 16619 7ff6c6484d74 16621 7ff6c648a948 __free_lconv_mon 11 API calls 16619->16621 16622 7ff6c6472d04 16620->16622 16621->16618 16622->16584 16624 7ff6c6484d9a 16624->16619 16626 7ff6c6484da4 16624->16626 16625 7ff6c6484d49 16627 7ff6c648a948 __free_lconv_mon 11 API calls 16625->16627 16629 7ff6c648a948 __free_lconv_mon 11 API calls 16626->16629 16627->16618 16628 7ff6c6484d40 16628->16619 16628->16625 16629->16618 16631 7ff6c6482fce 16630->16631 16632 7ff6c6482fbe 16630->16632 16633 7ff6c6482fd7 16631->16633 16639 7ff6c6483005 16631->16639 16634 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16632->16634 16635 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16633->16635 16636 7ff6c6482ffd 16634->16636 16635->16636 16636->16619 16636->16624 16636->16625 16636->16628 16639->16632 16639->16636 16641 7ff6c64839a4 16639->16641 16674 7ff6c64833f0 16639->16674 16711 7ff6c6482b80 16639->16711 16642 7ff6c6483a57 16641->16642 16643 7ff6c64839e6 16641->16643 16646 7ff6c6483a5c 16642->16646 16647 7ff6c6483ab0 16642->16647 16644 7ff6c64839ec 16643->16644 16645 7ff6c6483a81 16643->16645 16648 7ff6c64839f1 16644->16648 16649 7ff6c6483a20 16644->16649 16734 7ff6c6481d54 16645->16734 16650 7ff6c6483a91 16646->16650 16651 7ff6c6483a5e 16646->16651 16653 7ff6c6483ac7 16647->16653 16655 7ff6c6483aba 16647->16655 16659 7ff6c6483abf 16647->16659 16648->16653 16656 7ff6c64839f7 16648->16656 16649->16656 16649->16659 16741 7ff6c6481944 16650->16741 16654 7ff6c6483a00 16651->16654 16663 7ff6c6483a6d 16651->16663 16748 7ff6c64846ac 16653->16748 16672 7ff6c6483af0 16654->16672 16714 7ff6c6484158 16654->16714 16655->16645 16655->16659 16656->16654 16662 7ff6c6483a32 16656->16662 16670 7ff6c6483a1b 16656->16670 16659->16672 16752 7ff6c6482164 16659->16752 16662->16672 16724 7ff6c6484494 16662->16724 16663->16645 16665 7ff6c6483a72 16663->16665 16665->16672 16730 7ff6c6484558 16665->16730 16666 7ff6c647c550 _log10_special 8 API calls 16667 7ff6c6483dea 16666->16667 16667->16639 16670->16672 16673 7ff6c6483cdc 16670->16673 16759 7ff6c64847c0 16670->16759 16672->16666 16673->16672 16765 7ff6c648ea08 16673->16765 16675 7ff6c6483414 16674->16675 16676 7ff6c64833fe 16674->16676 16679 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16675->16679 16680 7ff6c6483454 16675->16680 16677 7ff6c6483a57 16676->16677 16678 7ff6c64839e6 16676->16678 16676->16680 16683 7ff6c6483a5c 16677->16683 16684 7ff6c6483ab0 16677->16684 16681 7ff6c64839ec 16678->16681 16682 7ff6c6483a81 16678->16682 16679->16680 16680->16639 16685 7ff6c64839f1 16681->16685 16686 7ff6c6483a20 16681->16686 16689 7ff6c6481d54 38 API calls 16682->16689 16687 7ff6c6483a91 16683->16687 16688 7ff6c6483a5e 16683->16688 16690 7ff6c6483ac7 16684->16690 16692 7ff6c6483aba 16684->16692 16696 7ff6c6483abf 16684->16696 16685->16690 16693 7ff6c64839f7 16685->16693 16686->16693 16686->16696 16694 7ff6c6481944 38 API calls 16687->16694 16691 7ff6c6483a00 16688->16691 16700 7ff6c6483a6d 16688->16700 16707 7ff6c6483a1b 16689->16707 16697 7ff6c64846ac 45 API calls 16690->16697 16695 7ff6c6484158 47 API calls 16691->16695 16710 7ff6c6483af0 16691->16710 16692->16682 16692->16696 16693->16691 16698 7ff6c6483a32 16693->16698 16693->16707 16694->16707 16695->16707 16699 7ff6c6482164 38 API calls 16696->16699 16696->16710 16697->16707 16701 7ff6c6484494 46 API calls 16698->16701 16698->16710 16699->16707 16700->16682 16702 7ff6c6483a72 16700->16702 16701->16707 16705 7ff6c6484558 37 API calls 16702->16705 16702->16710 16703 7ff6c647c550 _log10_special 8 API calls 16704 7ff6c6483dea 16703->16704 16704->16639 16705->16707 16706 7ff6c64847c0 45 API calls 16709 7ff6c6483cdc 16706->16709 16707->16706 16707->16709 16707->16710 16708 7ff6c648ea08 46 API calls 16708->16709 16709->16708 16709->16710 16710->16703 16991 7ff6c6480fc8 16711->16991 16715 7ff6c648417e 16714->16715 16777 7ff6c6480b80 16715->16777 16720 7ff6c64847c0 45 API calls 16721 7ff6c64842c3 16720->16721 16722 7ff6c64847c0 45 API calls 16721->16722 16723 7ff6c6484351 16721->16723 16722->16723 16723->16670 16725 7ff6c64844c9 16724->16725 16726 7ff6c648450e 16725->16726 16727 7ff6c64844e7 16725->16727 16728 7ff6c64847c0 45 API calls 16725->16728 16726->16670 16729 7ff6c648ea08 46 API calls 16727->16729 16728->16727 16729->16726 16733 7ff6c6484579 16730->16733 16731 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16732 7ff6c64845aa 16731->16732 16732->16670 16733->16731 16733->16732 16735 7ff6c6481d87 16734->16735 16736 7ff6c6481db6 16735->16736 16738 7ff6c6481e73 16735->16738 16740 7ff6c6481df3 16736->16740 16923 7ff6c6480c28 16736->16923 16739 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16738->16739 16739->16740 16740->16670 16742 7ff6c6481977 16741->16742 16743 7ff6c64819a6 16742->16743 16745 7ff6c6481a63 16742->16745 16744 7ff6c6480c28 12 API calls 16743->16744 16747 7ff6c64819e3 16743->16747 16744->16747 16746 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16745->16746 16746->16747 16747->16670 16749 7ff6c64846ef 16748->16749 16751 7ff6c64846f3 __crtLCMapStringW 16749->16751 16931 7ff6c6484748 16749->16931 16751->16670 16754 7ff6c6482197 16752->16754 16753 7ff6c64821c6 16755 7ff6c6480c28 12 API calls 16753->16755 16758 7ff6c6482203 16753->16758 16754->16753 16756 7ff6c6482283 16754->16756 16755->16758 16757 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16756->16757 16757->16758 16758->16670 16760 7ff6c64847d7 16759->16760 16935 7ff6c648d9b8 16760->16935 16766 7ff6c648ea39 16765->16766 16775 7ff6c648ea47 16765->16775 16767 7ff6c648ea67 16766->16767 16770 7ff6c64847c0 45 API calls 16766->16770 16766->16775 16768 7ff6c648ea9f 16767->16768 16769 7ff6c648ea78 16767->16769 16772 7ff6c648eac9 16768->16772 16773 7ff6c648eb2a 16768->16773 16768->16775 16981 7ff6c64900a0 16769->16981 16770->16767 16772->16775 16984 7ff6c648f8a0 16772->16984 16774 7ff6c648f8a0 _fread_nolock MultiByteToWideChar 16773->16774 16774->16775 16775->16673 16778 7ff6c6480bb7 16777->16778 16784 7ff6c6480ba6 16777->16784 16778->16784 16807 7ff6c648d5fc 16778->16807 16781 7ff6c6480bf8 16783 7ff6c648a948 __free_lconv_mon 11 API calls 16781->16783 16782 7ff6c648a948 __free_lconv_mon 11 API calls 16782->16781 16783->16784 16785 7ff6c648e570 16784->16785 16786 7ff6c648e5c0 16785->16786 16787 7ff6c648e58d 16785->16787 16786->16787 16789 7ff6c648e5f2 16786->16789 16788 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16787->16788 16797 7ff6c64842a1 16788->16797 16790 7ff6c648e705 16789->16790 16802 7ff6c648e63a 16789->16802 16791 7ff6c648e7f7 16790->16791 16793 7ff6c648e7bd 16790->16793 16795 7ff6c648e78c 16790->16795 16796 7ff6c648e74f 16790->16796 16799 7ff6c648e745 16790->16799 16847 7ff6c648da5c 16791->16847 16840 7ff6c648ddf4 16793->16840 16833 7ff6c648e0d4 16795->16833 16823 7ff6c648e304 16796->16823 16797->16720 16797->16721 16799->16793 16801 7ff6c648e74a 16799->16801 16801->16795 16801->16796 16802->16797 16814 7ff6c648a4a4 16802->16814 16805 7ff6c648a900 _isindst 17 API calls 16806 7ff6c648e854 16805->16806 16808 7ff6c648d647 16807->16808 16813 7ff6c648d60b _get_daylight 16807->16813 16809 7ff6c6484f08 _get_daylight 11 API calls 16808->16809 16811 7ff6c6480be4 16809->16811 16810 7ff6c648d62e HeapAlloc 16810->16811 16810->16813 16811->16781 16811->16782 16812 7ff6c6493590 _get_daylight 2 API calls 16812->16813 16813->16808 16813->16810 16813->16812 16815 7ff6c648a4b1 16814->16815 16816 7ff6c648a4bb 16814->16816 16815->16816 16821 7ff6c648a4d6 16815->16821 16817 7ff6c6484f08 _get_daylight 11 API calls 16816->16817 16818 7ff6c648a4c2 16817->16818 16856 7ff6c648a8e0 16818->16856 16820 7ff6c648a4ce 16820->16797 16820->16805 16821->16820 16822 7ff6c6484f08 _get_daylight 11 API calls 16821->16822 16822->16818 16859 7ff6c64940ac 16823->16859 16827 7ff6c648e401 16912 7ff6c648def0 16827->16912 16828 7ff6c648e3ac 16828->16827 16829 7ff6c648e3cc 16828->16829 16832 7ff6c648e3b0 16828->16832 16908 7ff6c648e1ac 16829->16908 16832->16797 16834 7ff6c64940ac 38 API calls 16833->16834 16835 7ff6c648e11e 16834->16835 16836 7ff6c6493af4 37 API calls 16835->16836 16837 7ff6c648e16e 16836->16837 16838 7ff6c648e172 16837->16838 16839 7ff6c648e1ac 45 API calls 16837->16839 16838->16797 16839->16838 16841 7ff6c64940ac 38 API calls 16840->16841 16842 7ff6c648de3f 16841->16842 16843 7ff6c6493af4 37 API calls 16842->16843 16844 7ff6c648de97 16843->16844 16845 7ff6c648de9b 16844->16845 16846 7ff6c648def0 45 API calls 16844->16846 16845->16797 16846->16845 16848 7ff6c648daa1 16847->16848 16849 7ff6c648dad4 16847->16849 16851 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16848->16851 16850 7ff6c648daec 16849->16850 16854 7ff6c648db6d 16849->16854 16853 7ff6c648ddf4 46 API calls 16850->16853 16852 7ff6c648dacd __scrt_get_show_window_mode 16851->16852 16852->16797 16853->16852 16854->16852 16855 7ff6c64847c0 45 API calls 16854->16855 16855->16852 16857 7ff6c648a778 _invalid_parameter_noinfo 37 API calls 16856->16857 16858 7ff6c648a8f9 16857->16858 16858->16820 16860 7ff6c64940ff fegetenv 16859->16860 16861 7ff6c6497e2c 37 API calls 16860->16861 16865 7ff6c6494152 16861->16865 16862 7ff6c649417f 16867 7ff6c648a4a4 __std_exception_copy 37 API calls 16862->16867 16863 7ff6c6494242 16864 7ff6c6497e2c 37 API calls 16863->16864 16866 7ff6c649426c 16864->16866 16865->16863 16868 7ff6c649416d 16865->16868 16869 7ff6c649421c 16865->16869 16870 7ff6c6497e2c 37 API calls 16866->16870 16871 7ff6c64941fd 16867->16871 16868->16862 16868->16863 16874 7ff6c648a4a4 __std_exception_copy 37 API calls 16869->16874 16872 7ff6c649427d 16870->16872 16873 7ff6c6495324 16871->16873 16878 7ff6c6494205 16871->16878 16875 7ff6c6498020 20 API calls 16872->16875 16876 7ff6c648a900 _isindst 17 API calls 16873->16876 16874->16871 16886 7ff6c64942e6 __scrt_get_show_window_mode 16875->16886 16877 7ff6c6495339 16876->16877 16879 7ff6c647c550 _log10_special 8 API calls 16878->16879 16880 7ff6c648e351 16879->16880 16904 7ff6c6493af4 16880->16904 16881 7ff6c649468f __scrt_get_show_window_mode 16882 7ff6c64949cf 16883 7ff6c6493c10 37 API calls 16882->16883 16890 7ff6c64950e7 16883->16890 16884 7ff6c649497b 16884->16882 16887 7ff6c649533c memcpy_s 37 API calls 16884->16887 16885 7ff6c6494327 memcpy_s 16898 7ff6c6494783 memcpy_s __scrt_get_show_window_mode 16885->16898 16901 7ff6c6494c6b memcpy_s __scrt_get_show_window_mode 16885->16901 16886->16881 16886->16885 16888 7ff6c6484f08 _get_daylight 11 API calls 16886->16888 16887->16882 16889 7ff6c6494760 16888->16889 16891 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 16889->16891 16893 7ff6c649533c memcpy_s 37 API calls 16890->16893 16897 7ff6c6495142 16890->16897 16891->16885 16892 7ff6c64952c8 16896 7ff6c6497e2c 37 API calls 16892->16896 16893->16897 16894 7ff6c6484f08 11 API calls _get_daylight 16894->16901 16895 7ff6c6484f08 11 API calls _get_daylight 16895->16898 16896->16878 16897->16892 16899 7ff6c6493c10 37 API calls 16897->16899 16902 7ff6c649533c memcpy_s 37 API calls 16897->16902 16898->16884 16898->16895 16900 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 16898->16900 16899->16897 16900->16898 16901->16882 16901->16884 16901->16894 16903 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 16901->16903 16902->16897 16903->16901 16905 7ff6c6493b13 16904->16905 16906 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16905->16906 16907 7ff6c6493b3e memcpy_s 16905->16907 16906->16907 16907->16828 16909 7ff6c648e1d8 memcpy_s 16908->16909 16910 7ff6c64847c0 45 API calls 16909->16910 16911 7ff6c648e292 memcpy_s __scrt_get_show_window_mode 16909->16911 16910->16911 16911->16832 16913 7ff6c648df2b 16912->16913 16917 7ff6c648df78 memcpy_s 16912->16917 16914 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16913->16914 16915 7ff6c648df57 16914->16915 16915->16832 16916 7ff6c648dfe3 16918 7ff6c648a4a4 __std_exception_copy 37 API calls 16916->16918 16917->16916 16917->16917 16919 7ff6c64847c0 45 API calls 16917->16919 16922 7ff6c648e025 memcpy_s 16918->16922 16919->16916 16920 7ff6c648a900 _isindst 17 API calls 16921 7ff6c648e0d0 16920->16921 16922->16920 16924 7ff6c6480c4e 16923->16924 16925 7ff6c6480c5f 16923->16925 16924->16740 16925->16924 16926 7ff6c648d5fc _fread_nolock 12 API calls 16925->16926 16927 7ff6c6480c90 16926->16927 16928 7ff6c6480ca4 16927->16928 16929 7ff6c648a948 __free_lconv_mon 11 API calls 16927->16929 16930 7ff6c648a948 __free_lconv_mon 11 API calls 16928->16930 16929->16928 16930->16924 16932 7ff6c6484766 16931->16932 16934 7ff6c648476e 16931->16934 16933 7ff6c64847c0 45 API calls 16932->16933 16933->16934 16934->16751 16936 7ff6c648d9d1 16935->16936 16938 7ff6c64847ff 16935->16938 16936->16938 16943 7ff6c6493304 16936->16943 16939 7ff6c648da24 16938->16939 16940 7ff6c648da3d 16939->16940 16942 7ff6c648480f 16939->16942 16940->16942 16978 7ff6c6492650 16940->16978 16942->16673 16955 7ff6c648b150 GetLastError 16943->16955 16946 7ff6c649335e 16946->16938 16956 7ff6c648b191 FlsSetValue 16955->16956 16957 7ff6c648b174 FlsGetValue 16955->16957 16958 7ff6c648b181 16956->16958 16959 7ff6c648b1a3 16956->16959 16957->16958 16960 7ff6c648b18b 16957->16960 16961 7ff6c648b1fd SetLastError 16958->16961 16962 7ff6c648eb98 _get_daylight 11 API calls 16959->16962 16960->16956 16964 7ff6c648b20a 16961->16964 16965 7ff6c648b21d 16961->16965 16963 7ff6c648b1b2 16962->16963 16967 7ff6c648b1d0 FlsSetValue 16963->16967 16968 7ff6c648b1c0 FlsSetValue 16963->16968 16964->16946 16977 7ff6c64902d8 EnterCriticalSection 16964->16977 16966 7ff6c648a504 __CxxCallCatchBlock 38 API calls 16965->16966 16969 7ff6c648b222 16966->16969 16971 7ff6c648b1ee 16967->16971 16972 7ff6c648b1dc FlsSetValue 16967->16972 16970 7ff6c648b1c9 16968->16970 16973 7ff6c648a948 __free_lconv_mon 11 API calls 16970->16973 16974 7ff6c648aef4 _get_daylight 11 API calls 16971->16974 16972->16970 16973->16958 16975 7ff6c648b1f6 16974->16975 16976 7ff6c648a948 __free_lconv_mon 11 API calls 16975->16976 16976->16961 16979 7ff6c648b150 __CxxCallCatchBlock 45 API calls 16978->16979 16980 7ff6c6492659 16979->16980 16987 7ff6c6496d88 16981->16987 16986 7ff6c648f8a9 MultiByteToWideChar 16984->16986 16989 7ff6c6496dec 16987->16989 16988 7ff6c647c550 _log10_special 8 API calls 16990 7ff6c64900bd 16988->16990 16989->16988 16990->16775 16992 7ff6c6480ffd 16991->16992 16993 7ff6c648100f 16991->16993 16994 7ff6c6484f08 _get_daylight 11 API calls 16992->16994 16995 7ff6c648101d 16993->16995 16999 7ff6c6481059 16993->16999 16996 7ff6c6481002 16994->16996 16998 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 16995->16998 16997 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 16996->16997 17004 7ff6c648100d 16997->17004 16998->17004 17000 7ff6c64813d5 16999->17000 17001 7ff6c6484f08 _get_daylight 11 API calls 16999->17001 17002 7ff6c6484f08 _get_daylight 11 API calls 17000->17002 17000->17004 17003 7ff6c64813ca 17001->17003 17005 7ff6c6481669 17002->17005 17007 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17003->17007 17004->16639 17006 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17005->17006 17006->17004 17007->17000 17009 7ff6c6480704 17008->17009 17036 7ff6c6480464 17009->17036 17011 7ff6c648071d 17011->16173 17048 7ff6c64803bc 17012->17048 17016 7ff6c647c850 17015->17016 17017 7ff6c6472930 GetCurrentProcessId 17016->17017 17018 7ff6c6471c80 49 API calls 17017->17018 17019 7ff6c6472979 17018->17019 17062 7ff6c6484984 17019->17062 17024 7ff6c6471c80 49 API calls 17025 7ff6c64729ff 17024->17025 17092 7ff6c6472620 17025->17092 17028 7ff6c647c550 _log10_special 8 API calls 17029 7ff6c6472a31 17028->17029 17029->16212 17031 7ff6c6471b89 17030->17031 17032 7ff6c6480119 17030->17032 17031->16211 17031->16212 17033 7ff6c6484f08 _get_daylight 11 API calls 17032->17033 17034 7ff6c648011e 17033->17034 17035 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17034->17035 17035->17031 17037 7ff6c64804ce 17036->17037 17038 7ff6c648048e 17036->17038 17037->17038 17040 7ff6c64804da 17037->17040 17039 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17038->17039 17041 7ff6c64804b5 17039->17041 17047 7ff6c648546c EnterCriticalSection 17040->17047 17041->17011 17049 7ff6c64803e6 17048->17049 17050 7ff6c6471a20 17048->17050 17049->17050 17051 7ff6c64803f5 __scrt_get_show_window_mode 17049->17051 17052 7ff6c6480432 17049->17052 17050->16181 17050->16182 17054 7ff6c6484f08 _get_daylight 11 API calls 17051->17054 17061 7ff6c648546c EnterCriticalSection 17052->17061 17056 7ff6c648040a 17054->17056 17058 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17056->17058 17058->17050 17064 7ff6c64849de 17062->17064 17063 7ff6c6484a03 17066 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17063->17066 17064->17063 17065 7ff6c6484a3f 17064->17065 17101 7ff6c6482c10 17065->17101 17068 7ff6c6484a2d 17066->17068 17071 7ff6c647c550 _log10_special 8 API calls 17068->17071 17069 7ff6c648a948 __free_lconv_mon 11 API calls 17069->17068 17070 7ff6c6484ae8 17075 7ff6c6484b1c 17070->17075 17078 7ff6c6484af1 17070->17078 17073 7ff6c64729c3 17071->17073 17080 7ff6c6485160 17073->17080 17074 7ff6c6484b40 17074->17075 17076 7ff6c6484b4a 17074->17076 17075->17069 17079 7ff6c648a948 __free_lconv_mon 11 API calls 17076->17079 17077 7ff6c648a948 __free_lconv_mon 11 API calls 17077->17068 17078->17077 17079->17068 17081 7ff6c648b2c8 _get_daylight 11 API calls 17080->17081 17082 7ff6c6485177 17081->17082 17083 7ff6c64851b7 17082->17083 17084 7ff6c648eb98 _get_daylight 11 API calls 17082->17084 17089 7ff6c64729e5 17082->17089 17083->17089 17239 7ff6c648ec20 17083->17239 17085 7ff6c64851ac 17084->17085 17086 7ff6c648a948 __free_lconv_mon 11 API calls 17085->17086 17086->17083 17089->17024 17090 7ff6c648a900 _isindst 17 API calls 17091 7ff6c64851fc 17090->17091 17093 7ff6c647262f 17092->17093 17094 7ff6c6479390 2 API calls 17093->17094 17095 7ff6c6472660 17094->17095 17096 7ff6c6472683 MessageBoxA 17095->17096 17097 7ff6c647266f MessageBoxW 17095->17097 17098 7ff6c6472690 17096->17098 17097->17098 17099 7ff6c647c550 _log10_special 8 API calls 17098->17099 17100 7ff6c64726a0 17099->17100 17100->17028 17102 7ff6c6482c4e 17101->17102 17103 7ff6c6482c3e 17101->17103 17104 7ff6c6482c57 17102->17104 17108 7ff6c6482c85 17102->17108 17105 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17103->17105 17106 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17104->17106 17107 7ff6c6482c7d 17105->17107 17106->17107 17107->17070 17107->17074 17107->17075 17107->17078 17108->17103 17108->17107 17109 7ff6c64847c0 45 API calls 17108->17109 17111 7ff6c6482f34 17108->17111 17115 7ff6c64835a0 17108->17115 17141 7ff6c6483268 17108->17141 17171 7ff6c6482af0 17108->17171 17109->17108 17113 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17111->17113 17113->17103 17116 7ff6c6483655 17115->17116 17117 7ff6c64835e2 17115->17117 17120 7ff6c648365a 17116->17120 17121 7ff6c64836af 17116->17121 17118 7ff6c64835e8 17117->17118 17119 7ff6c648367f 17117->17119 17128 7ff6c64835ed 17118->17128 17132 7ff6c64836be 17118->17132 17188 7ff6c6481b50 17119->17188 17122 7ff6c648365c 17120->17122 17123 7ff6c648368f 17120->17123 17121->17119 17121->17132 17139 7ff6c6483618 17121->17139 17125 7ff6c64835fd 17122->17125 17131 7ff6c648366b 17122->17131 17195 7ff6c6481740 17123->17195 17140 7ff6c64836ed 17125->17140 17174 7ff6c6483f04 17125->17174 17128->17125 17130 7ff6c6483630 17128->17130 17128->17139 17130->17140 17184 7ff6c64843c0 17130->17184 17131->17119 17134 7ff6c6483670 17131->17134 17132->17140 17202 7ff6c6481f60 17132->17202 17136 7ff6c6484558 37 API calls 17134->17136 17134->17140 17135 7ff6c647c550 _log10_special 8 API calls 17137 7ff6c6483983 17135->17137 17136->17139 17137->17108 17139->17140 17209 7ff6c648e858 17139->17209 17140->17135 17142 7ff6c6483289 17141->17142 17143 7ff6c6483273 17141->17143 17146 7ff6c64832c7 17142->17146 17147 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17142->17147 17144 7ff6c6483655 17143->17144 17145 7ff6c64835e2 17143->17145 17143->17146 17150 7ff6c648365a 17144->17150 17151 7ff6c64836af 17144->17151 17148 7ff6c64835e8 17145->17148 17149 7ff6c648367f 17145->17149 17146->17108 17147->17146 17158 7ff6c64835ed 17148->17158 17160 7ff6c64836be 17148->17160 17154 7ff6c6481b50 38 API calls 17149->17154 17152 7ff6c648365c 17150->17152 17153 7ff6c648368f 17150->17153 17151->17149 17151->17160 17168 7ff6c6483618 17151->17168 17155 7ff6c64835fd 17152->17155 17162 7ff6c648366b 17152->17162 17156 7ff6c6481740 38 API calls 17153->17156 17154->17168 17157 7ff6c6483f04 47 API calls 17155->17157 17170 7ff6c64836ed 17155->17170 17156->17168 17157->17168 17158->17155 17159 7ff6c6483630 17158->17159 17158->17168 17163 7ff6c64843c0 47 API calls 17159->17163 17159->17170 17161 7ff6c6481f60 38 API calls 17160->17161 17160->17170 17161->17168 17162->17149 17164 7ff6c6483670 17162->17164 17163->17168 17166 7ff6c6484558 37 API calls 17164->17166 17164->17170 17165 7ff6c647c550 _log10_special 8 API calls 17167 7ff6c6483983 17165->17167 17166->17168 17167->17108 17169 7ff6c648e858 47 API calls 17168->17169 17168->17170 17169->17168 17170->17165 17222 7ff6c6480d14 17171->17222 17175 7ff6c6483f26 17174->17175 17176 7ff6c6480b80 12 API calls 17175->17176 17177 7ff6c6483f6e 17176->17177 17178 7ff6c648e570 46 API calls 17177->17178 17179 7ff6c6484041 17178->17179 17180 7ff6c64847c0 45 API calls 17179->17180 17182 7ff6c6484063 17179->17182 17180->17182 17181 7ff6c64847c0 45 API calls 17183 7ff6c64840ec 17181->17183 17182->17181 17182->17182 17182->17183 17183->17139 17185 7ff6c64843d8 17184->17185 17187 7ff6c6484440 17184->17187 17186 7ff6c648e858 47 API calls 17185->17186 17185->17187 17186->17187 17187->17139 17190 7ff6c6481b83 17188->17190 17189 7ff6c6481bb2 17191 7ff6c6480b80 12 API calls 17189->17191 17194 7ff6c6481bef 17189->17194 17190->17189 17192 7ff6c6481c6f 17190->17192 17191->17194 17193 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17192->17193 17193->17194 17194->17139 17196 7ff6c6481773 17195->17196 17197 7ff6c64817a2 17196->17197 17199 7ff6c648185f 17196->17199 17198 7ff6c6480b80 12 API calls 17197->17198 17201 7ff6c64817df 17197->17201 17198->17201 17200 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17199->17200 17200->17201 17201->17139 17203 7ff6c6481f93 17202->17203 17204 7ff6c6481fc2 17203->17204 17206 7ff6c648207f 17203->17206 17205 7ff6c6480b80 12 API calls 17204->17205 17208 7ff6c6481fff 17204->17208 17205->17208 17207 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17206->17207 17207->17208 17208->17139 17210 7ff6c648e880 17209->17210 17211 7ff6c648e8c5 17210->17211 17213 7ff6c64847c0 45 API calls 17210->17213 17217 7ff6c648e885 __scrt_get_show_window_mode 17210->17217 17218 7ff6c648e8ae __scrt_get_show_window_mode 17210->17218 17211->17217 17211->17218 17219 7ff6c64907e8 17211->17219 17212 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17212->17217 17213->17211 17217->17139 17218->17212 17218->17217 17220 7ff6c649080c WideCharToMultiByte 17219->17220 17223 7ff6c6480d53 17222->17223 17224 7ff6c6480d41 17222->17224 17227 7ff6c6480d60 17223->17227 17230 7ff6c6480d9d 17223->17230 17225 7ff6c6484f08 _get_daylight 11 API calls 17224->17225 17226 7ff6c6480d46 17225->17226 17228 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17226->17228 17229 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17227->17229 17238 7ff6c6480d51 17228->17238 17229->17238 17231 7ff6c6480e46 17230->17231 17233 7ff6c6484f08 _get_daylight 11 API calls 17230->17233 17232 7ff6c6484f08 _get_daylight 11 API calls 17231->17232 17231->17238 17234 7ff6c6480ef0 17232->17234 17235 7ff6c6480e3b 17233->17235 17237 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17234->17237 17236 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17235->17236 17236->17231 17237->17238 17238->17108 17243 7ff6c648ec3d 17239->17243 17240 7ff6c648ec42 17241 7ff6c64851dd 17240->17241 17242 7ff6c6484f08 _get_daylight 11 API calls 17240->17242 17241->17089 17241->17090 17244 7ff6c648ec4c 17242->17244 17243->17240 17243->17241 17246 7ff6c648ec8c 17243->17246 17245 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17244->17245 17245->17241 17246->17241 17247 7ff6c6484f08 _get_daylight 11 API calls 17246->17247 17247->17244 17249 7ff6c6478633 __vcrt_freefls 17248->17249 17250 7ff6c64785b1 GetTokenInformation 17248->17250 17253 7ff6c647864c 17249->17253 17254 7ff6c6478646 CloseHandle 17249->17254 17251 7ff6c64785dd 17250->17251 17252 7ff6c64785d2 GetLastError 17250->17252 17251->17249 17255 7ff6c64785f9 GetTokenInformation 17251->17255 17252->17249 17252->17251 17253->16230 17254->17253 17255->17249 17256 7ff6c647861c 17255->17256 17256->17249 17257 7ff6c6478626 ConvertSidToStringSidW 17256->17257 17257->17249 17259 7ff6c647c850 17258->17259 17260 7ff6c6472b74 GetCurrentProcessId 17259->17260 17261 7ff6c64726b0 48 API calls 17260->17261 17262 7ff6c6472bc7 17261->17262 17263 7ff6c6484bd8 48 API calls 17262->17263 17264 7ff6c6472c10 MessageBoxW 17263->17264 17265 7ff6c647c550 _log10_special 8 API calls 17264->17265 17266 7ff6c6472c40 17265->17266 17266->16240 17268 7ff6c64725e5 17267->17268 17269 7ff6c6484bd8 48 API calls 17268->17269 17270 7ff6c6472604 17269->17270 17270->16255 17316 7ff6c6488794 17271->17316 17275 7ff6c64781dc 17274->17275 17276 7ff6c6479390 2 API calls 17275->17276 17277 7ff6c64781fb 17276->17277 17278 7ff6c6478216 ExpandEnvironmentStringsW 17277->17278 17279 7ff6c6478203 17277->17279 17281 7ff6c647823c __vcrt_freefls 17278->17281 17280 7ff6c6472810 49 API calls 17279->17280 17286 7ff6c647820f __vcrt_freefls 17280->17286 17282 7ff6c6478253 17281->17282 17283 7ff6c6478240 17281->17283 17288 7ff6c6478261 GetDriveTypeW 17282->17288 17289 7ff6c64782bf 17282->17289 17284 7ff6c6472810 49 API calls 17283->17284 17284->17286 17285 7ff6c647c550 _log10_special 8 API calls 17287 7ff6c64783af 17285->17287 17286->17285 17287->16254 17306 7ff6c6488238 17287->17306 17293 7ff6c6478295 17288->17293 17294 7ff6c64782b0 17288->17294 17454 7ff6c6487e08 17289->17454 17292 7ff6c64782d1 17296 7ff6c64782ec 17292->17296 17297 7ff6c64782d9 17292->17297 17298 7ff6c6472810 49 API calls 17293->17298 17447 7ff6c648796c 17294->17447 17300 7ff6c647834e CreateDirectoryW 17296->17300 17302 7ff6c64726b0 48 API calls 17296->17302 17299 7ff6c6472810 49 API calls 17297->17299 17298->17286 17299->17286 17300->17286 17301 7ff6c647835d GetLastError 17300->17301 17301->17286 17303 7ff6c647836a GetLastError 17301->17303 17304 7ff6c6478328 CreateDirectoryW 17302->17304 17304->17296 17307 7ff6c6488245 17306->17307 17308 7ff6c6488258 17306->17308 17310 7ff6c6484f08 _get_daylight 11 API calls 17307->17310 17555 7ff6c6487ebc 17308->17555 17311 7ff6c648824a 17310->17311 17312 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17311->17312 17314 7ff6c6488256 17312->17314 17314->16258 17357 7ff6c6491558 17316->17357 17416 7ff6c64912d0 17357->17416 17437 7ff6c64902d8 EnterCriticalSection 17416->17437 17448 7ff6c648798a 17447->17448 17451 7ff6c64879bd 17447->17451 17448->17451 17466 7ff6c6490474 17448->17466 17451->17286 17452 7ff6c648a900 _isindst 17 API calls 17453 7ff6c64879ed 17452->17453 17455 7ff6c6487e24 17454->17455 17456 7ff6c6487e92 17454->17456 17455->17456 17458 7ff6c6487e29 17455->17458 17500 7ff6c64907c0 17456->17500 17459 7ff6c6487e41 17458->17459 17460 7ff6c6487e5e 17458->17460 17475 7ff6c6487bd8 GetFullPathNameW 17459->17475 17483 7ff6c6487c4c GetFullPathNameW 17460->17483 17465 7ff6c6487e56 __vcrt_freefls 17465->17292 17467 7ff6c649048b 17466->17467 17468 7ff6c6490481 17466->17468 17469 7ff6c6484f08 _get_daylight 11 API calls 17467->17469 17468->17467 17473 7ff6c64904a7 17468->17473 17470 7ff6c6490493 17469->17470 17471 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17470->17471 17472 7ff6c64879b9 17471->17472 17472->17451 17472->17452 17473->17472 17474 7ff6c6484f08 _get_daylight 11 API calls 17473->17474 17474->17470 17476 7ff6c6487bfe GetLastError 17475->17476 17479 7ff6c6487c14 17475->17479 17477 7ff6c6484e7c _fread_nolock 11 API calls 17476->17477 17480 7ff6c6487c0b 17477->17480 17478 7ff6c6487c10 17478->17465 17479->17478 17481 7ff6c6484f08 _get_daylight 11 API calls 17479->17481 17482 7ff6c6484f08 _get_daylight 11 API calls 17480->17482 17481->17478 17482->17478 17484 7ff6c6487c7f GetLastError 17483->17484 17489 7ff6c6487c95 __vcrt_freefls 17483->17489 17485 7ff6c6484e7c _fread_nolock 11 API calls 17484->17485 17486 7ff6c6487c8c 17485->17486 17487 7ff6c6484f08 _get_daylight 11 API calls 17486->17487 17488 7ff6c6487c91 17487->17488 17491 7ff6c6487d24 17488->17491 17489->17488 17490 7ff6c6487cef GetFullPathNameW 17489->17490 17490->17484 17490->17488 17492 7ff6c6487d98 memcpy_s 17491->17492 17495 7ff6c6487d4d __scrt_get_show_window_mode 17491->17495 17492->17465 17493 7ff6c6487d81 17494 7ff6c6484f08 _get_daylight 11 API calls 17493->17494 17496 7ff6c6487d86 17494->17496 17495->17492 17495->17493 17497 7ff6c6487dba 17495->17497 17497->17492 17499 7ff6c6484f08 _get_daylight 11 API calls 17497->17499 17499->17496 17503 7ff6c64905d0 17500->17503 17504 7ff6c6490612 17503->17504 17505 7ff6c64905fb 17503->17505 17507 7ff6c6490616 17504->17507 17508 7ff6c6490637 17504->17508 17506 7ff6c6484f08 _get_daylight 11 API calls 17505->17506 17523 7ff6c6490600 17506->17523 17529 7ff6c649073c 17507->17529 17541 7ff6c648f5b8 17508->17541 17512 7ff6c649061f 17515 7ff6c6484ee8 _fread_nolock 11 API calls 17512->17515 17513 7ff6c649063c 17517 7ff6c64906e1 17513->17517 17524 7ff6c6490663 17513->17524 17514 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17528 7ff6c649060b __vcrt_freefls 17514->17528 17517->17505 17519 7ff6c647c550 _log10_special 8 API calls 17522 7ff6c6490731 17519->17522 17522->17465 17523->17514 17528->17519 17530 7ff6c6490786 17529->17530 17531 7ff6c6490756 17529->17531 17532 7ff6c6490791 GetDriveTypeW 17530->17532 17533 7ff6c6490771 17530->17533 17534 7ff6c6484ee8 _fread_nolock 11 API calls 17531->17534 17532->17533 17536 7ff6c647c550 _log10_special 8 API calls 17533->17536 17535 7ff6c649075b 17534->17535 17537 7ff6c6484f08 _get_daylight 11 API calls 17535->17537 17538 7ff6c649061b 17536->17538 17539 7ff6c6490766 17537->17539 17538->17512 17538->17513 17540 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17539->17540 17540->17533 17542 7ff6c649a4d0 __scrt_get_show_window_mode 17541->17542 17543 7ff6c648f5ee GetCurrentDirectoryW 17542->17543 17544 7ff6c648f605 17543->17544 17545 7ff6c648f62c 17543->17545 17547 7ff6c647c550 _log10_special 8 API calls 17544->17547 17546 7ff6c648eb98 _get_daylight 11 API calls 17545->17546 17548 7ff6c648f63b 17546->17548 17549 7ff6c648f699 17547->17549 17550 7ff6c648f654 17548->17550 17551 7ff6c648f645 GetCurrentDirectoryW 17548->17551 17549->17513 17551->17550 17562 7ff6c64902d8 EnterCriticalSection 17555->17562 17564 7ff6c647456a 17563->17564 17565 7ff6c6479390 2 API calls 17564->17565 17566 7ff6c647458f 17565->17566 17567 7ff6c647c550 _log10_special 8 API calls 17566->17567 17568 7ff6c64745b7 17567->17568 17568->16293 17571 7ff6c6477e2e 17569->17571 17570 7ff6c6477f52 17574 7ff6c647c550 _log10_special 8 API calls 17570->17574 17571->17570 17572 7ff6c6471c80 49 API calls 17571->17572 17573 7ff6c6477eb5 17572->17573 17573->17570 17576 7ff6c6471c80 49 API calls 17573->17576 17577 7ff6c6474560 10 API calls 17573->17577 17578 7ff6c6479390 2 API calls 17573->17578 17575 7ff6c6477f83 17574->17575 17575->16293 17576->17573 17577->17573 17579 7ff6c6477f23 CreateDirectoryW 17578->17579 17579->17570 17579->17573 17581 7ff6c6471637 17580->17581 17582 7ff6c6471613 17580->17582 17584 7ff6c64745c0 108 API calls 17581->17584 17703 7ff6c6471050 17582->17703 17586 7ff6c647164b 17584->17586 17585 7ff6c6471618 17589 7ff6c647162e 17585->17589 17592 7ff6c6472710 54 API calls 17585->17592 17587 7ff6c6471682 17586->17587 17588 7ff6c6471653 17586->17588 17591 7ff6c64745c0 108 API calls 17587->17591 17590 7ff6c6484f08 _get_daylight 11 API calls 17588->17590 17589->16293 17593 7ff6c6471658 17590->17593 17594 7ff6c6471696 17591->17594 17592->17589 17595 7ff6c6472910 54 API calls 17593->17595 17596 7ff6c64716b8 17594->17596 17597 7ff6c647169e 17594->17597 17598 7ff6c6471671 17595->17598 17600 7ff6c64806d4 73 API calls 17596->17600 17599 7ff6c6472710 54 API calls 17597->17599 17598->16293 17601 7ff6c64716ae 17599->17601 17602 7ff6c64716cd 17600->17602 17607 7ff6c648004c 74 API calls 17601->17607 17603 7ff6c64716f9 17602->17603 17604 7ff6c64716d1 17602->17604 17605 7ff6c6471717 17603->17605 17606 7ff6c64716ff 17603->17606 17608 7ff6c6484f08 _get_daylight 11 API calls 17604->17608 17613 7ff6c6471739 17605->17613 17623 7ff6c6471761 17605->17623 17679 7ff6c6471210 17606->17679 17611 7ff6c6471829 17607->17611 17609 7ff6c64716d6 17608->17609 17612 7ff6c6472910 54 API calls 17609->17612 17611->16293 17619 7ff6c64716ef __vcrt_freefls 17612->17619 17615 7ff6c6484f08 _get_daylight 11 API calls 17613->17615 17614 7ff6c648004c 74 API calls 17614->17601 17616 7ff6c647173e 17615->17616 17618 7ff6c6472910 54 API calls 17616->17618 17617 7ff6c648039c _fread_nolock 53 API calls 17617->17623 17618->17619 17619->17614 17620 7ff6c64717da 17622 7ff6c6484f08 _get_daylight 11 API calls 17620->17622 17624 7ff6c64717ca 17622->17624 17623->17617 17623->17619 17623->17620 17625 7ff6c64717c5 17623->17625 17734 7ff6c6480adc 17623->17734 17626 7ff6c6472910 54 API calls 17624->17626 17627 7ff6c6484f08 _get_daylight 11 API calls 17625->17627 17626->17619 17627->17624 17629 7ff6c6477144 17628->17629 17631 7ff6c647718b 17628->17631 17629->17631 17771 7ff6c6485024 17629->17771 17631->16293 17633 7ff6c64741a1 17632->17633 17634 7ff6c64744e0 49 API calls 17633->17634 17635 7ff6c64741db 17634->17635 17636 7ff6c64744e0 49 API calls 17635->17636 17637 7ff6c64741eb 17636->17637 17638 7ff6c647423c 17637->17638 17639 7ff6c647420d 17637->17639 17641 7ff6c6474110 51 API calls 17638->17641 17802 7ff6c6474110 17639->17802 17642 7ff6c647423a 17641->17642 17643 7ff6c647429c 17642->17643 17644 7ff6c6474267 17642->17644 17646 7ff6c6474110 51 API calls 17643->17646 17809 7ff6c6477cf0 17644->17809 17648 7ff6c64742c0 17646->17648 17651 7ff6c6474110 51 API calls 17648->17651 17656 7ff6c6474312 17648->17656 17649 7ff6c6474393 17655 7ff6c6471950 115 API calls 17649->17655 17650 7ff6c6472710 54 API calls 17652 7ff6c6474297 17650->17652 17654 7ff6c64742e9 17651->17654 17653 7ff6c647c550 _log10_special 8 API calls 17652->17653 17657 7ff6c6474435 17653->17657 17654->17656 17659 7ff6c6474110 51 API calls 17654->17659 17658 7ff6c647439d 17655->17658 17656->17649 17662 7ff6c647438c 17656->17662 17665 7ff6c6474317 17656->17665 17667 7ff6c647437b 17656->17667 17657->16293 17660 7ff6c64743a5 17658->17660 17661 7ff6c64743fe 17658->17661 17659->17656 17835 7ff6c6471840 17660->17835 17663 7ff6c6472710 54 API calls 17661->17663 17662->17660 17662->17665 17663->17665 17668 7ff6c6472710 54 API calls 17665->17668 17671 7ff6c6472710 54 API calls 17667->17671 17668->17652 17669 7ff6c64743bc 17672 7ff6c6472710 54 API calls 17669->17672 17670 7ff6c64743d2 17673 7ff6c6471600 118 API calls 17670->17673 17671->17665 17672->17652 17674 7ff6c64743e0 17673->17674 17674->17652 17675 7ff6c6472710 54 API calls 17674->17675 17675->17652 17677 7ff6c6471c80 49 API calls 17676->17677 17678 7ff6c6474474 17677->17678 17678->16293 17680 7ff6c6471268 17679->17680 17681 7ff6c6471297 17680->17681 17682 7ff6c647126f 17680->17682 17685 7ff6c64712d4 17681->17685 17686 7ff6c64712b1 17681->17686 17683 7ff6c6472710 54 API calls 17682->17683 17684 7ff6c6471282 17683->17684 17684->17619 17690 7ff6c64712e6 17685->17690 17701 7ff6c6471309 memcpy_s 17685->17701 17687 7ff6c6484f08 _get_daylight 11 API calls 17686->17687 17688 7ff6c64712b6 17687->17688 17689 7ff6c6472910 54 API calls 17688->17689 17693 7ff6c64712cf 17689->17693 17691 7ff6c6484f08 _get_daylight 11 API calls 17690->17691 17694 7ff6c64712eb 17691->17694 17692 7ff6c648039c _fread_nolock 53 API calls 17692->17701 17738 7ff6c647ba60 17693->17738 17696 7ff6c6472910 54 API calls 17694->17696 17696->17693 17697 7ff6c6471443 __vcrt_freefls 17697->17619 17698 7ff6c64713cf 17699 7ff6c6472710 54 API calls 17698->17699 17699->17693 17700 7ff6c6480adc 76 API calls 17700->17701 17701->17692 17701->17693 17701->17698 17701->17700 17702 7ff6c6480110 37 API calls 17701->17702 17702->17701 17704 7ff6c64745c0 108 API calls 17703->17704 17705 7ff6c647108c 17704->17705 17706 7ff6c64710a9 17705->17706 17707 7ff6c6471094 17705->17707 17709 7ff6c64806d4 73 API calls 17706->17709 17708 7ff6c6472710 54 API calls 17707->17708 17715 7ff6c64710a4 __vcrt_freefls 17708->17715 17710 7ff6c64710bf 17709->17710 17711 7ff6c64710e6 17710->17711 17712 7ff6c64710c3 17710->17712 17717 7ff6c64710f7 17711->17717 17718 7ff6c6471122 17711->17718 17713 7ff6c6484f08 _get_daylight 11 API calls 17712->17713 17714 7ff6c64710c8 17713->17714 17716 7ff6c6472910 54 API calls 17714->17716 17715->17585 17722 7ff6c64710e1 __vcrt_freefls 17716->17722 17719 7ff6c6484f08 _get_daylight 11 API calls 17717->17719 17720 7ff6c647113c 17718->17720 17721 7ff6c6471129 17718->17721 17723 7ff6c6471100 17719->17723 17720->17722 17727 7ff6c648039c _fread_nolock 53 API calls 17720->17727 17730 7ff6c64711ed 17720->17730 17724 7ff6c6471210 92 API calls 17721->17724 17726 7ff6c648004c 74 API calls 17722->17726 17725 7ff6c6472910 54 API calls 17723->17725 17724->17722 17725->17722 17728 7ff6c64711b4 17726->17728 17727->17720 17728->17715 17742 7ff6c64746f0 17728->17742 17731 7ff6c6484f08 _get_daylight 11 API calls 17730->17731 17732 7ff6c64711f2 17731->17732 17733 7ff6c6472910 54 API calls 17732->17733 17733->17722 17735 7ff6c6480b0c 17734->17735 17756 7ff6c648082c 17735->17756 17737 7ff6c6480b2a 17737->17623 17739 7ff6c647ba6e 17738->17739 17740 7ff6c647bab2 17738->17740 17739->17740 17741 7ff6c648a948 11 API calls 17739->17741 17740->17697 17741->17740 17743 7ff6c6474700 17742->17743 17744 7ff6c6479390 2 API calls 17743->17744 17745 7ff6c647472b 17744->17745 17746 7ff6c6479390 2 API calls 17745->17746 17752 7ff6c647479e 17745->17752 17748 7ff6c6474746 17746->17748 17747 7ff6c647c550 _log10_special 8 API calls 17749 7ff6c64747b9 17747->17749 17750 7ff6c647474b CreateSymbolicLinkW 17748->17750 17748->17752 17749->17715 17751 7ff6c6474775 17750->17751 17750->17752 17751->17752 17753 7ff6c647477e GetLastError 17751->17753 17752->17747 17753->17752 17757 7ff6c648084c 17756->17757 17758 7ff6c6480879 17756->17758 17757->17758 17759 7ff6c6480856 17757->17759 17760 7ff6c6480881 17757->17760 17758->17737 17761 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 17759->17761 17763 7ff6c648076c 17760->17763 17761->17758 17770 7ff6c648546c EnterCriticalSection 17763->17770 17772 7ff6c648505e 17771->17772 17773 7ff6c6485031 17771->17773 17774 7ff6c6485081 17772->17774 17778 7ff6c648509d 17772->17778 17775 7ff6c6484f08 _get_daylight 11 API calls 17773->17775 17783 7ff6c6484fe8 17773->17783 17777 7ff6c6484f08 _get_daylight 11 API calls 17774->17777 17776 7ff6c648503b 17775->17776 17779 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17776->17779 17780 7ff6c6485086 17777->17780 17786 7ff6c6484f4c 17778->17786 17782 7ff6c6485046 17779->17782 17784 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17780->17784 17782->17629 17783->17629 17785 7ff6c6485091 17784->17785 17785->17629 17787 7ff6c6484f70 17786->17787 17793 7ff6c6484f6b 17786->17793 17788 7ff6c648b150 __CxxCallCatchBlock 45 API calls 17787->17788 17787->17793 17789 7ff6c6484f8b 17788->17789 17794 7ff6c648d984 17789->17794 17793->17785 17795 7ff6c648d999 17794->17795 17797 7ff6c6484fae 17794->17797 17796 7ff6c6493304 45 API calls 17795->17796 17795->17797 17796->17797 17798 7ff6c648d9f0 17797->17798 17799 7ff6c648da05 17798->17799 17800 7ff6c648da18 17798->17800 17799->17800 17801 7ff6c6492650 45 API calls 17799->17801 17800->17793 17801->17800 17803 7ff6c6474136 17802->17803 17804 7ff6c6484984 49 API calls 17803->17804 17805 7ff6c647415c 17804->17805 17806 7ff6c647416d 17805->17806 17807 7ff6c6474560 10 API calls 17805->17807 17806->17642 17808 7ff6c647417f 17807->17808 17808->17642 17810 7ff6c6477d05 17809->17810 17811 7ff6c64745c0 108 API calls 17810->17811 17813 7ff6c6477d2b 17811->17813 17812 7ff6c6477d52 17816 7ff6c647c550 _log10_special 8 API calls 17812->17816 17813->17812 17814 7ff6c64745c0 108 API calls 17813->17814 17815 7ff6c6477d42 17814->17815 17818 7ff6c6477d5c 17815->17818 17819 7ff6c6477d4d 17815->17819 17817 7ff6c6474277 17816->17817 17817->17650 17817->17652 17839 7ff6c64800e4 17818->17839 17821 7ff6c648004c 74 API calls 17819->17821 17821->17812 17822 7ff6c6477dbf 17823 7ff6c648004c 74 API calls 17822->17823 17825 7ff6c6477de7 17823->17825 17824 7ff6c648039c _fread_nolock 53 API calls 17833 7ff6c6477d61 17824->17833 17826 7ff6c648004c 74 API calls 17825->17826 17826->17812 17827 7ff6c6477dc6 17828 7ff6c6480110 37 API calls 17827->17828 17830 7ff6c6477dc1 17828->17830 17829 7ff6c6480adc 76 API calls 17829->17833 17830->17822 17845 7ff6c6487318 17830->17845 17831 7ff6c6480110 37 API calls 17831->17833 17833->17822 17833->17824 17833->17827 17833->17829 17833->17830 17833->17831 17834 7ff6c64800e4 37 API calls 17833->17834 17834->17833 17837 7ff6c64718d5 17835->17837 17838 7ff6c6471865 17835->17838 17836 7ff6c6485024 45 API calls 17836->17838 17837->17669 17837->17670 17838->17836 17838->17837 17840 7ff6c64800ed 17839->17840 17841 7ff6c64800fd 17839->17841 17842 7ff6c6484f08 _get_daylight 11 API calls 17840->17842 17841->17833 17843 7ff6c64800f2 17842->17843 17844 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17843->17844 17844->17841 17846 7ff6c6487320 17845->17846 17866 7ff6c6485ec8 17865->17866 17867 7ff6c6485eee 17866->17867 17870 7ff6c6485f21 17866->17870 17868 7ff6c6484f08 _get_daylight 11 API calls 17867->17868 17869 7ff6c6485ef3 17868->17869 17871 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 17869->17871 17872 7ff6c6485f27 17870->17872 17873 7ff6c6485f34 17870->17873 17883 7ff6c6474616 17871->17883 17874 7ff6c6484f08 _get_daylight 11 API calls 17872->17874 17884 7ff6c648ac28 17873->17884 17874->17883 17883->16318 17897 7ff6c64902d8 EnterCriticalSection 17884->17897 18257 7ff6c64878f8 18256->18257 18260 7ff6c64873d4 18257->18260 18259 7ff6c6487911 18259->16326 18261 7ff6c64873ef 18260->18261 18262 7ff6c648741e 18260->18262 18263 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 18261->18263 18270 7ff6c648546c EnterCriticalSection 18262->18270 18266 7ff6c648740f 18263->18266 18266->18259 18272 7ff6c647fe43 18271->18272 18273 7ff6c647fe71 18271->18273 18274 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 18272->18274 18280 7ff6c647fe63 18273->18280 18281 7ff6c648546c EnterCriticalSection 18273->18281 18274->18280 18280->16332 18283 7ff6c647caf2 RtlLookupFunctionEntry 18282->18283 18284 7ff6c647cb08 RtlVirtualUnwind 18283->18284 18285 7ff6c647c90b 18283->18285 18284->18283 18284->18285 18286 7ff6c647c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 18285->18286 18288 7ff6c64745c0 108 API calls 18287->18288 18289 7ff6c6471493 18288->18289 18290 7ff6c64714bc 18289->18290 18291 7ff6c647149b 18289->18291 18293 7ff6c64806d4 73 API calls 18290->18293 18292 7ff6c6472710 54 API calls 18291->18292 18294 7ff6c64714ab 18292->18294 18295 7ff6c64714d1 18293->18295 18294->16374 18296 7ff6c64714f8 18295->18296 18297 7ff6c64714d5 18295->18297 18301 7ff6c6471508 18296->18301 18302 7ff6c6471532 18296->18302 18298 7ff6c6484f08 _get_daylight 11 API calls 18297->18298 18299 7ff6c64714da 18298->18299 18300 7ff6c6472910 54 API calls 18299->18300 18305 7ff6c64714f3 __vcrt_freefls 18300->18305 18303 7ff6c6484f08 _get_daylight 11 API calls 18301->18303 18304 7ff6c6471538 18302->18304 18312 7ff6c647154b 18302->18312 18306 7ff6c6471510 18303->18306 18307 7ff6c6471210 92 API calls 18304->18307 18309 7ff6c648004c 74 API calls 18305->18309 18308 7ff6c6472910 54 API calls 18306->18308 18307->18305 18308->18305 18311 7ff6c64715c4 18309->18311 18310 7ff6c648039c _fread_nolock 53 API calls 18310->18312 18311->16374 18312->18305 18312->18310 18313 7ff6c64715d6 18312->18313 18314 7ff6c6484f08 _get_daylight 11 API calls 18313->18314 18315 7ff6c64715db 18314->18315 18316 7ff6c6472910 54 API calls 18315->18316 18316->18305 18318 7ff6c6479390 2 API calls 18317->18318 18319 7ff6c6478e94 LoadLibraryExW 18318->18319 18320 7ff6c6478eb3 __vcrt_freefls 18319->18320 18320->16408 18394 7ff6c6476375 18393->18394 18395 7ff6c6471c80 49 API calls 18394->18395 18396 7ff6c64763b1 18395->18396 18397 7ff6c64763dd 18396->18397 18398 7ff6c64763ba 18396->18398 18400 7ff6c6474630 49 API calls 18397->18400 18399 7ff6c6472710 54 API calls 18398->18399 18401 7ff6c64763d3 18399->18401 18402 7ff6c64763f5 18400->18402 18405 7ff6c647c550 _log10_special 8 API calls 18401->18405 18403 7ff6c6476413 18402->18403 18406 7ff6c6472710 54 API calls 18402->18406 18404 7ff6c6474560 10 API calls 18403->18404 18407 7ff6c647641d 18404->18407 18408 7ff6c647336e 18405->18408 18406->18403 18409 7ff6c647642b 18407->18409 18410 7ff6c6478e80 3 API calls 18407->18410 18408->16443 18424 7ff6c6476500 18408->18424 18411 7ff6c6474630 49 API calls 18409->18411 18410->18409 18412 7ff6c6476444 18411->18412 18413 7ff6c6476469 18412->18413 18414 7ff6c6476449 18412->18414 18416 7ff6c6478e80 3 API calls 18413->18416 18415 7ff6c6472710 54 API calls 18414->18415 18415->18401 18417 7ff6c6476476 18416->18417 18418 7ff6c6476482 18417->18418 18419 7ff6c64764c1 18417->18419 18421 7ff6c6479390 2 API calls 18418->18421 18483 7ff6c6475830 GetProcAddress 18419->18483 18422 7ff6c647649a GetLastError 18421->18422 18423 7ff6c6472c50 51 API calls 18422->18423 18423->18401 18573 7ff6c6475400 18424->18573 18426 7ff6c6476526 18427 7ff6c647652e 18426->18427 18428 7ff6c647653f 18426->18428 18429 7ff6c6472710 54 API calls 18427->18429 18580 7ff6c6474c90 18428->18580 18435 7ff6c647653a 18429->18435 18432 7ff6c647655c 18436 7ff6c647656c 18432->18436 18438 7ff6c647657d 18432->18438 18433 7ff6c647654b 18434 7ff6c6472710 54 API calls 18433->18434 18434->18435 18435->16445 18437 7ff6c6472710 54 API calls 18436->18437 18437->18435 18439 7ff6c647659c 18438->18439 18440 7ff6c64765ad 18438->18440 18441 7ff6c6472710 54 API calls 18439->18441 18442 7ff6c64765bc 18440->18442 18443 7ff6c64765cd 18440->18443 18441->18435 18444 7ff6c6472710 54 API calls 18442->18444 18584 7ff6c6474d50 18443->18584 18444->18435 18462 7ff6c6476070 18461->18462 18462->18462 18463 7ff6c6476099 18462->18463 18469 7ff6c64760b0 __vcrt_freefls 18462->18469 18464 7ff6c6472710 54 API calls 18463->18464 18465 7ff6c64760a5 18464->18465 18465->16447 18466 7ff6c64761bb 18466->16447 18467 7ff6c6471470 116 API calls 18467->18469 18468 7ff6c6472710 54 API calls 18468->18469 18469->18466 18469->18467 18469->18468 18484 7ff6c6475852 GetLastError 18483->18484 18485 7ff6c647587f GetProcAddress 18483->18485 18486 7ff6c647585f 18484->18486 18487 7ff6c64758aa GetProcAddress 18485->18487 18488 7ff6c647589b GetLastError 18485->18488 18489 7ff6c6472c50 51 API calls 18486->18489 18490 7ff6c64758c6 GetLastError 18487->18490 18491 7ff6c64758d5 GetProcAddress 18487->18491 18488->18486 18492 7ff6c6475874 18489->18492 18490->18486 18493 7ff6c6475903 GetProcAddress 18491->18493 18494 7ff6c64758f1 GetLastError 18491->18494 18492->18401 18495 7ff6c6475931 GetProcAddress 18493->18495 18496 7ff6c647591f GetLastError 18493->18496 18494->18486 18496->18486 18575 7ff6c647542c 18573->18575 18574 7ff6c6475434 18574->18426 18575->18574 18578 7ff6c64755d4 18575->18578 18604 7ff6c6486aa4 18575->18604 18576 7ff6c6475797 __vcrt_freefls 18576->18426 18577 7ff6c64747d0 47 API calls 18577->18578 18578->18576 18578->18577 18581 7ff6c6474cc0 18580->18581 18582 7ff6c647c550 _log10_special 8 API calls 18581->18582 18583 7ff6c6474d2a 18582->18583 18583->18432 18583->18433 18605 7ff6c6486ad4 18604->18605 18608 7ff6c6485fa0 18605->18608 18607 7ff6c6486b04 18607->18575 18609 7ff6c6485fe3 18608->18609 18610 7ff6c6485fd1 18608->18610 18611 7ff6c648602d 18609->18611 18614 7ff6c6485ff0 18609->18614 18612 7ff6c6484f08 _get_daylight 11 API calls 18610->18612 18615 7ff6c6486048 18611->18615 18618 7ff6c64847c0 45 API calls 18611->18618 18613 7ff6c6485fd6 18612->18613 18616 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18613->18616 18617 7ff6c648a814 _invalid_parameter_noinfo 37 API calls 18614->18617 18620 7ff6c648606a 18615->18620 18629 7ff6c6486a2c 18615->18629 18626 7ff6c6485fe1 18616->18626 18617->18626 18618->18615 18621 7ff6c648610b 18620->18621 18623 7ff6c6484f08 _get_daylight 11 API calls 18620->18623 18622 7ff6c6484f08 _get_daylight 11 API calls 18621->18622 18621->18626 18625 7ff6c64861b6 18622->18625 18624 7ff6c6486100 18623->18624 18627 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18624->18627 18628 7ff6c648a8e0 _invalid_parameter_noinfo 37 API calls 18625->18628 18626->18607 18627->18621 18628->18626 18630 7ff6c6486a66 18629->18630 18631 7ff6c6486a4f 18629->18631 18633 7ff6c6486a54 18630->18633 18640 7ff6c648ff98 18630->18640 18635 7ff6c648ff68 18631->18635 18633->18615 18636 7ff6c648b150 __CxxCallCatchBlock 45 API calls 18635->18636 18637 7ff6c648ff71 18636->18637 18638 7ff6c648d984 45 API calls 18637->18638 18641 7ff6c6484f4c 45 API calls 18640->18641 18642 7ff6c648ffd1 18641->18642 18645 7ff6c648ffdd 18642->18645 18647 7ff6c6492e40 18642->18647 18681->16451 18683 7ff6c648b150 __CxxCallCatchBlock 45 API calls 18682->18683 18684 7ff6c648a3e1 18683->18684 18687 7ff6c648a504 18684->18687 18696 7ff6c6493650 18687->18696 18722 7ff6c6493608 18696->18722 18727 7ff6c64902d8 EnterCriticalSection 18722->18727 19068 7ff6c649ad69 19071 7ff6c6485478 LeaveCriticalSection 19068->19071 19469 7ff6c649abe3 19470 7ff6c649abf3 19469->19470 19473 7ff6c6485478 LeaveCriticalSection 19470->19473 18844 7ff6c647bae0 18845 7ff6c647bb0e 18844->18845 18846 7ff6c647baf5 18844->18846 18846->18845 18848 7ff6c648d5fc 12 API calls 18846->18848 18847 7ff6c647bb6e 18848->18847

                                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                                  Function 00007FF6C64789E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 0 7ff6c64789e0-7ff6c6478b26 call 7ff6c647c850 call 7ff6c6479390 SetConsoleCtrlHandler GetStartupInfoW call 7ff6c64853f0 call 7ff6c648a47c call 7ff6c648871c call 7ff6c64853f0 call 7ff6c648a47c call 7ff6c648871c call 7ff6c64853f0 call 7ff6c648a47c call 7ff6c648871c GetCommandLineW CreateProcessW 23 7ff6c6478b4d-7ff6c6478b89 RegisterClassW 0->23 24 7ff6c6478b28-7ff6c6478b48 GetLastError call 7ff6c6472c50 0->24 26 7ff6c6478b8b GetLastError 23->26 27 7ff6c6478b91-7ff6c6478be5 CreateWindowExW 23->27 31 7ff6c6478e39-7ff6c6478e5f call 7ff6c647c550 24->31 26->27 29 7ff6c6478be7-7ff6c6478bed GetLastError 27->29 30 7ff6c6478bef-7ff6c6478bf4 ShowWindow 27->30 32 7ff6c6478bfa-7ff6c6478c0a WaitForSingleObject 29->32 30->32 34 7ff6c6478c0c 32->34 35 7ff6c6478c88-7ff6c6478c8f 32->35 39 7ff6c6478c10-7ff6c6478c13 34->39 36 7ff6c6478cd2-7ff6c6478cd9 35->36 37 7ff6c6478c91-7ff6c6478ca1 WaitForSingleObject 35->37 42 7ff6c6478dc0-7ff6c6478dd9 GetMessageW 36->42 43 7ff6c6478cdf-7ff6c6478cf5 QueryPerformanceFrequency QueryPerformanceCounter 36->43 40 7ff6c6478df8-7ff6c6478e02 37->40 41 7ff6c6478ca7-7ff6c6478cb7 TerminateProcess 37->41 44 7ff6c6478c1b-7ff6c6478c22 39->44 45 7ff6c6478c15 GetLastError 39->45 46 7ff6c6478e04-7ff6c6478e0a DestroyWindow 40->46 47 7ff6c6478e11-7ff6c6478e35 GetExitCodeProcess CloseHandle * 2 40->47 48 7ff6c6478cb9 GetLastError 41->48 49 7ff6c6478cbf-7ff6c6478ccd WaitForSingleObject 41->49 52 7ff6c6478ddb-7ff6c6478de9 TranslateMessage DispatchMessageW 42->52 53 7ff6c6478def-7ff6c6478df6 42->53 50 7ff6c6478d00-7ff6c6478d38 MsgWaitForMultipleObjects PeekMessageW 43->50 44->37 51 7ff6c6478c24-7ff6c6478c41 PeekMessageW 44->51 45->44 46->47 47->31 48->49 49->40 54 7ff6c6478d3a 50->54 55 7ff6c6478d73-7ff6c6478d7a 50->55 56 7ff6c6478c76-7ff6c6478c86 WaitForSingleObject 51->56 57 7ff6c6478c43-7ff6c6478c74 TranslateMessage DispatchMessageW PeekMessageW 51->57 52->53 53->40 53->42 58 7ff6c6478d40-7ff6c6478d71 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->42 59 7ff6c6478d7c-7ff6c6478da5 QueryPerformanceCounter 55->59 56->35 56->39 57->56 57->57 58->55 58->58 59->50 60 7ff6c6478dab-7ff6c6478db2 59->60 60->40 61 7ff6c6478db4-7ff6c6478db8 60->61 61->42
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                                  • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                                  • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                                  • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                  • Instruction ID: e46b3422caff0c66be677cbe01320cadcf5573a6f4d79e1c8d3ca6592c38c0f0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8BD19331A18B828AEB11CF34E8542AE3764FF85B5AF40C235DA9D83AA4DF3DD544C748
                                                                                                                                                                                                                                                  Function 00007FF6C6471000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 62 7ff6c6471000-7ff6c6473806 call 7ff6c647fe18 call 7ff6c647fe20 call 7ff6c647c850 call 7ff6c64853f0 call 7ff6c6485484 call 7ff6c64736b0 76 7ff6c6473808-7ff6c647380f 62->76 77 7ff6c6473814-7ff6c6473836 call 7ff6c6471950 62->77 78 7ff6c6473c97-7ff6c6473cb2 call 7ff6c647c550 76->78 82 7ff6c647383c-7ff6c6473856 call 7ff6c6471c80 77->82 83 7ff6c647391b-7ff6c6473931 call 7ff6c64745c0 77->83 87 7ff6c647385b-7ff6c647389b call 7ff6c6478830 82->87 90 7ff6c647396a-7ff6c647397f call 7ff6c6472710 83->90 91 7ff6c6473933-7ff6c6473960 call 7ff6c6477f90 83->91 97 7ff6c647389d-7ff6c64738a3 87->97 98 7ff6c64738c1-7ff6c64738cc call 7ff6c6484f30 87->98 101 7ff6c6473c8f 90->101 99 7ff6c6473984-7ff6c64739a6 call 7ff6c6471c80 91->99 100 7ff6c6473962-7ff6c6473965 call 7ff6c648004c 91->100 102 7ff6c64738a5-7ff6c64738ad 97->102 103 7ff6c64738af-7ff6c64738bd call 7ff6c64789a0 97->103 109 7ff6c64739fc-7ff6c6473a2a call 7ff6c6478940 call 7ff6c64789a0 * 3 98->109 110 7ff6c64738d2-7ff6c64738e1 call 7ff6c6478830 98->110 115 7ff6c64739b0-7ff6c64739b9 99->115 100->90 101->78 102->103 103->98 138 7ff6c6473a2f-7ff6c6473a3e call 7ff6c6478830 109->138 119 7ff6c64738e7-7ff6c64738ed 110->119 120 7ff6c64739f4-7ff6c64739f7 call 7ff6c6484f30 110->120 115->115 118 7ff6c64739bb-7ff6c64739d8 call 7ff6c6471950 115->118 118->87 130 7ff6c64739de-7ff6c64739ef call 7ff6c6472710 118->130 124 7ff6c64738f0-7ff6c64738fc 119->124 120->109 127 7ff6c6473905-7ff6c6473908 124->127 128 7ff6c64738fe-7ff6c6473903 124->128 127->120 131 7ff6c647390e-7ff6c6473916 call 7ff6c6484f30 127->131 128->124 128->127 130->101 131->138 141 7ff6c6473a44-7ff6c6473a47 138->141 142 7ff6c6473b45-7ff6c6473b53 138->142 141->142 145 7ff6c6473a4d-7ff6c6473a50 141->145 143 7ff6c6473b59-7ff6c6473b5d 142->143 144 7ff6c6473a67 142->144 146 7ff6c6473a6b-7ff6c6473a90 call 7ff6c6484f30 143->146 144->146 147 7ff6c6473a56-7ff6c6473a5a 145->147 148 7ff6c6473b14-7ff6c6473b17 145->148 157 7ff6c6473aab-7ff6c6473ac0 146->157 158 7ff6c6473a92-7ff6c6473aa6 call 7ff6c6478940 146->158 147->148 149 7ff6c6473a60 147->149 150 7ff6c6473b19-7ff6c6473b1d 148->150 151 7ff6c6473b2f-7ff6c6473b40 call 7ff6c6472710 148->151 149->144 150->151 153 7ff6c6473b1f-7ff6c6473b2a 150->153 159 7ff6c6473c7f-7ff6c6473c87 151->159 153->146 161 7ff6c6473be8-7ff6c6473bfa call 7ff6c6478830 157->161 162 7ff6c6473ac6-7ff6c6473aca 157->162 158->157 159->101 170 7ff6c6473bfc-7ff6c6473c02 161->170 171 7ff6c6473c2e 161->171 164 7ff6c6473bcd-7ff6c6473be2 call 7ff6c6471940 162->164 165 7ff6c6473ad0-7ff6c6473ae8 call 7ff6c6485250 162->165 164->161 164->162 175 7ff6c6473aea-7ff6c6473b02 call 7ff6c6485250 165->175 176 7ff6c6473b62-7ff6c6473b7a call 7ff6c6485250 165->176 173 7ff6c6473c04-7ff6c6473c1c 170->173 174 7ff6c6473c1e-7ff6c6473c2c 170->174 177 7ff6c6473c31-7ff6c6473c40 call 7ff6c6484f30 171->177 173->177 174->177 175->164 188 7ff6c6473b08-7ff6c6473b0f 175->188 186 7ff6c6473b7c-7ff6c6473b80 176->186 187 7ff6c6473b87-7ff6c6473b9f call 7ff6c6485250 176->187 184 7ff6c6473c46-7ff6c6473c4a 177->184 185 7ff6c6473d41-7ff6c6473d63 call 7ff6c64744e0 177->185 189 7ff6c6473cd4-7ff6c6473ce6 call 7ff6c6478830 184->189 190 7ff6c6473c50-7ff6c6473c5f call 7ff6c64790e0 184->190 199 7ff6c6473d65-7ff6c6473d6f call 7ff6c6474630 185->199 200 7ff6c6473d71-7ff6c6473d82 call 7ff6c6471c80 185->200 186->187 201 7ff6c6473bac-7ff6c6473bc4 call 7ff6c6485250 187->201 202 7ff6c6473ba1-7ff6c6473ba5 187->202 188->164 206 7ff6c6473ce8-7ff6c6473ceb 189->206 207 7ff6c6473d35-7ff6c6473d3c 189->207 204 7ff6c6473cb3-7ff6c6473cb6 call 7ff6c6478660 190->204 205 7ff6c6473c61 190->205 214 7ff6c6473d87-7ff6c6473d96 199->214 200->214 201->164 217 7ff6c6473bc6 201->217 202->201 216 7ff6c6473cbb-7ff6c6473cbd 204->216 211 7ff6c6473c68 call 7ff6c6472710 205->211 206->207 212 7ff6c6473ced-7ff6c6473d10 call 7ff6c6471c80 206->212 207->211 225 7ff6c6473c6d-7ff6c6473c77 211->225 229 7ff6c6473d2b-7ff6c6473d33 call 7ff6c6484f30 212->229 230 7ff6c6473d12-7ff6c6473d26 call 7ff6c6472710 call 7ff6c6484f30 212->230 220 7ff6c6473d98-7ff6c6473d9f 214->220 221 7ff6c6473dc4-7ff6c6473dda call 7ff6c6479390 214->221 223 7ff6c6473cc8-7ff6c6473ccf 216->223 224 7ff6c6473cbf-7ff6c6473cc6 216->224 217->164 220->221 227 7ff6c6473da1-7ff6c6473da5 220->227 233 7ff6c6473ddc 221->233 234 7ff6c6473de8-7ff6c6473e04 SetDllDirectoryW 221->234 223->214 224->211 225->159 227->221 231 7ff6c6473da7-7ff6c6473dbe SetDllDirectoryW LoadLibraryExW 227->231 229->214 230->225 231->221 233->234 237 7ff6c6473e0a-7ff6c6473e19 call 7ff6c6478830 234->237 238 7ff6c6473f01-7ff6c6473f08 234->238 251 7ff6c6473e1b-7ff6c6473e21 237->251 252 7ff6c6473e32-7ff6c6473e3c call 7ff6c6484f30 237->252 240 7ff6c6474008-7ff6c6474010 238->240 241 7ff6c6473f0e-7ff6c6473f15 238->241 245 7ff6c6474035-7ff6c6474067 call 7ff6c64736a0 call 7ff6c6473360 call 7ff6c6473670 call 7ff6c6476fc0 call 7ff6c6476d70 240->245 246 7ff6c6474012-7ff6c647402f PostMessageW GetMessageW 240->246 241->240 244 7ff6c6473f1b-7ff6c6473f25 call 7ff6c64733c0 241->244 244->225 258 7ff6c6473f2b-7ff6c6473f3f call 7ff6c64790c0 244->258 246->245 255 7ff6c6473e2d-7ff6c6473e2f 251->255 256 7ff6c6473e23-7ff6c6473e2b 251->256 263 7ff6c6473ef2-7ff6c6473efc call 7ff6c6478940 252->263 264 7ff6c6473e42-7ff6c6473e48 252->264 255->252 256->255 271 7ff6c6473f64-7ff6c6473f7a call 7ff6c6478940 call 7ff6c64789e0 258->271 272 7ff6c6473f41-7ff6c6473f5e PostMessageW GetMessageW 258->272 263->238 264->263 268 7ff6c6473e4e-7ff6c6473e54 264->268 269 7ff6c6473e56-7ff6c6473e58 268->269 270 7ff6c6473e5f-7ff6c6473e61 268->270 274 7ff6c6473e5a 269->274 275 7ff6c6473e67-7ff6c6473e83 call 7ff6c6476dc0 call 7ff6c6477340 269->275 270->238 270->275 285 7ff6c6473f7f-7ff6c6473fa7 call 7ff6c6476fc0 call 7ff6c6476d70 call 7ff6c64788e0 271->285 272->271 274->238 289 7ff6c6473e85-7ff6c6473e8c 275->289 290 7ff6c6473e8e-7ff6c6473e95 275->290 310 7ff6c6473fa9-7ff6c6473fbf call 7ff6c6478ed0 call 7ff6c64788e0 285->310 311 7ff6c6473ff5-7ff6c6474003 call 7ff6c6471900 285->311 292 7ff6c6473edb-7ff6c6473ef0 call 7ff6c6472a50 call 7ff6c6476fc0 call 7ff6c6476d70 289->292 293 7ff6c6473e97-7ff6c6473ea4 call 7ff6c6476e00 290->293 294 7ff6c6473eaf-7ff6c6473eb9 call 7ff6c64771b0 290->294 292->238 293->294 308 7ff6c6473ea6-7ff6c6473ead 293->308 304 7ff6c6473ebb-7ff6c6473ec2 294->304 305 7ff6c6473ec4-7ff6c6473ed2 call 7ff6c64774f0 294->305 304->292 305->238 318 7ff6c6473ed4 305->318 308->292 310->311 323 7ff6c6473fc1-7ff6c6473fd6 310->323 311->225 318->292 324 7ff6c6473fd8-7ff6c6473feb call 7ff6c6472710 call 7ff6c6471900 323->324 325 7ff6c6473ff0 call 7ff6c6472a50 323->325 324->225 325->311
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                                  • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                                  • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                                  • Opcode ID: 56efb0c328102eab1d406dba677a265d22c75a80e3e063e6a6bdbd0eb2694019
                                                                                                                                                                                                                                                  • Instruction ID: f0e89fd1bd5235cce201497c603e408134e91843401e6c2fff6d6cecd8d40d4b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 56efb0c328102eab1d406dba677a265d22c75a80e3e063e6a6bdbd0eb2694019
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F832AF21A0C68295FB27DF2095553B93792AF55786F84C032DADDC32D6EF2EE598C308
                                                                                                                                                                                                                                                  Function 00007FF6C6495C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 479 7ff6c6495c00-7ff6c6495c3b call 7ff6c6495588 call 7ff6c6495590 call 7ff6c64955f8 486 7ff6c6495c41-7ff6c6495c4c call 7ff6c6495598 479->486 487 7ff6c6495e65-7ff6c6495eb1 call 7ff6c648a900 call 7ff6c6495588 call 7ff6c6495590 call 7ff6c64955f8 479->487 486->487 493 7ff6c6495c52-7ff6c6495c5c 486->493 514 7ff6c6495fef-7ff6c649605d call 7ff6c648a900 call 7ff6c6491578 487->514 515 7ff6c6495eb7-7ff6c6495ec2 call 7ff6c6495598 487->515 495 7ff6c6495c7e-7ff6c6495c82 493->495 496 7ff6c6495c5e-7ff6c6495c61 493->496 497 7ff6c6495c85-7ff6c6495c8d 495->497 499 7ff6c6495c64-7ff6c6495c6f 496->499 497->497 500 7ff6c6495c8f-7ff6c6495ca2 call 7ff6c648d5fc 497->500 502 7ff6c6495c71-7ff6c6495c78 499->502 503 7ff6c6495c7a-7ff6c6495c7c 499->503 509 7ff6c6495ca4-7ff6c6495ca6 call 7ff6c648a948 500->509 510 7ff6c6495cba-7ff6c6495cc6 call 7ff6c648a948 500->510 502->499 502->503 503->495 504 7ff6c6495cab-7ff6c6495cb9 503->504 509->504 520 7ff6c6495ccd-7ff6c6495cd5 510->520 532 7ff6c649605f-7ff6c6496066 514->532 533 7ff6c649606b-7ff6c649606e 514->533 515->514 524 7ff6c6495ec8-7ff6c6495ed3 call 7ff6c64955c8 515->524 520->520 523 7ff6c6495cd7-7ff6c6495ce8 call 7ff6c6490474 520->523 523->487 534 7ff6c6495cee-7ff6c6495d44 call 7ff6c649a4d0 * 4 call 7ff6c6495b1c 523->534 524->514 531 7ff6c6495ed9-7ff6c6495efc call 7ff6c648a948 GetTimeZoneInformation 524->531 547 7ff6c6495f02-7ff6c6495f23 531->547 548 7ff6c6495fc4-7ff6c6495fee call 7ff6c6495580 call 7ff6c6495570 call 7ff6c6495578 531->548 537 7ff6c64960fb-7ff6c64960fe 532->537 538 7ff6c6496070 533->538 539 7ff6c64960a5-7ff6c64960b8 call 7ff6c648d5fc 533->539 591 7ff6c6495d46-7ff6c6495d4a 534->591 543 7ff6c6496073 call 7ff6c6495e7c 537->543 544 7ff6c6496104-7ff6c649610c call 7ff6c6495c00 537->544 538->543 552 7ff6c64960c3-7ff6c64960de call 7ff6c6491578 539->552 553 7ff6c64960ba 539->553 558 7ff6c6496078-7ff6c64960a4 call 7ff6c648a948 call 7ff6c647c550 543->558 544->558 555 7ff6c6495f2e-7ff6c6495f35 547->555 556 7ff6c6495f25-7ff6c6495f2b 547->556 575 7ff6c64960e0-7ff6c64960e3 552->575 576 7ff6c64960e5-7ff6c64960f7 call 7ff6c648a948 552->576 559 7ff6c64960bc-7ff6c64960c1 call 7ff6c648a948 553->559 562 7ff6c6495f37-7ff6c6495f3f 555->562 563 7ff6c6495f49 555->563 556->555 559->538 562->563 570 7ff6c6495f41-7ff6c6495f47 562->570 568 7ff6c6495f4b-7ff6c6495fbf call 7ff6c649a4d0 * 4 call 7ff6c6492b5c call 7ff6c6496114 * 2 563->568 568->548 570->568 575->559 576->537 593 7ff6c6495d50-7ff6c6495d54 591->593 594 7ff6c6495d4c 591->594 593->591 597 7ff6c6495d56-7ff6c6495d7b call 7ff6c6486b58 593->597 594->593 602 7ff6c6495d7e-7ff6c6495d82 597->602 604 7ff6c6495d91-7ff6c6495d95 602->604 605 7ff6c6495d84-7ff6c6495d8f 602->605 604->602 605->604 607 7ff6c6495d97-7ff6c6495d9b 605->607 609 7ff6c6495e1c-7ff6c6495e20 607->609 610 7ff6c6495d9d-7ff6c6495dc5 call 7ff6c6486b58 607->610 612 7ff6c6495e22-7ff6c6495e24 609->612 613 7ff6c6495e27-7ff6c6495e34 609->613 619 7ff6c6495de3-7ff6c6495de7 610->619 620 7ff6c6495dc7 610->620 612->613 615 7ff6c6495e4f-7ff6c6495e5e call 7ff6c6495580 call 7ff6c6495570 613->615 616 7ff6c6495e36-7ff6c6495e4c call 7ff6c6495b1c 613->616 615->487 616->615 619->609 625 7ff6c6495de9-7ff6c6495e07 call 7ff6c6486b58 619->625 623 7ff6c6495dca-7ff6c6495dd1 620->623 623->619 626 7ff6c6495dd3-7ff6c6495de1 623->626 631 7ff6c6495e13-7ff6c6495e1a 625->631 626->619 626->623 631->609 632 7ff6c6495e09-7ff6c6495e0d 631->632 632->609 633 7ff6c6495e0f 632->633 633->631
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495C45
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6495598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C64955AC
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A95E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A948: GetLastError.KERNEL32(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A968
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6C648A8DF,?,?,?,?,?,00007FF6C648A7CA), ref: 00007FF6C648A909
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6C648A8DF,?,?,?,?,?,00007FF6C648A7CA), ref: 00007FF6C648A92E
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495C34
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C64955F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C649560C
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495EAA
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495EBB
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495ECC
                                                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6C649610C), ref: 00007FF6C6495EF3
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                  • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                                  • Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                  • Instruction ID: 2ab0fa4a187f8febd07f43f4c7c10db24a2fecfc028ea926eeba3c04a751df50
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 86D10622A4824246EB2AEF22D6401B97365FF84799F50C136EA8DC7796DF3EE441C748
                                                                                                                                                                                                                                                  Function 00007FF6C6496964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 693 7ff6c6496964-7ff6c64969d7 call 7ff6c6496698 696 7ff6c64969f1-7ff6c64969fb call 7ff6c6488520 693->696 697 7ff6c64969d9-7ff6c64969e2 call 7ff6c6484ee8 693->697 703 7ff6c6496a16-7ff6c6496a7f CreateFileW 696->703 704 7ff6c64969fd-7ff6c6496a14 call 7ff6c6484ee8 call 7ff6c6484f08 696->704 702 7ff6c64969e5-7ff6c64969ec call 7ff6c6484f08 697->702 716 7ff6c6496d32-7ff6c6496d52 702->716 707 7ff6c6496a81-7ff6c6496a87 703->707 708 7ff6c6496afc-7ff6c6496b07 GetFileType 703->708 704->702 713 7ff6c6496ac9-7ff6c6496af7 GetLastError call 7ff6c6484e7c 707->713 714 7ff6c6496a89-7ff6c6496a8d 707->714 710 7ff6c6496b09-7ff6c6496b44 GetLastError call 7ff6c6484e7c CloseHandle 708->710 711 7ff6c6496b5a-7ff6c6496b61 708->711 710->702 727 7ff6c6496b4a-7ff6c6496b55 call 7ff6c6484f08 710->727 719 7ff6c6496b63-7ff6c6496b67 711->719 720 7ff6c6496b69-7ff6c6496b6c 711->720 713->702 714->713 721 7ff6c6496a8f-7ff6c6496ac7 CreateFileW 714->721 725 7ff6c6496b72-7ff6c6496bc7 call 7ff6c6488438 719->725 720->725 726 7ff6c6496b6e 720->726 721->708 721->713 731 7ff6c6496be6-7ff6c6496c17 call 7ff6c6496418 725->731 732 7ff6c6496bc9-7ff6c6496bd5 call 7ff6c64968a0 725->732 726->725 727->702 739 7ff6c6496c19-7ff6c6496c1b 731->739 740 7ff6c6496c1d-7ff6c6496c5f 731->740 732->731 738 7ff6c6496bd7 732->738 741 7ff6c6496bd9-7ff6c6496be1 call 7ff6c648aac0 738->741 739->741 742 7ff6c6496c81-7ff6c6496c8c 740->742 743 7ff6c6496c61-7ff6c6496c65 740->743 741->716 746 7ff6c6496d30 742->746 747 7ff6c6496c92-7ff6c6496c96 742->747 743->742 745 7ff6c6496c67-7ff6c6496c7c 743->745 745->742 746->716 747->746 748 7ff6c6496c9c-7ff6c6496ce1 CloseHandle CreateFileW 747->748 750 7ff6c6496ce3-7ff6c6496d11 GetLastError call 7ff6c6484e7c call 7ff6c6488660 748->750 751 7ff6c6496d16-7ff6c6496d2b 748->751 750->751 751->746
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1617910340-0
                                                                                                                                                                                                                                                  • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                  • Instruction ID: 86a57796bb01af0ecdafec2a24e11485e4d402d1676db54a3b4697ae2f7fabfa
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 99C1E132B28A4185EB11CF68C5906BD3765FB89B99B01C239DEAE977D4DF3AD011C344
                                                                                                                                                                                                                                                  Function 00007FF6C6495E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 959 7ff6c6495e7c-7ff6c6495eb1 call 7ff6c6495588 call 7ff6c6495590 call 7ff6c64955f8 966 7ff6c6495fef-7ff6c649605d call 7ff6c648a900 call 7ff6c6491578 959->966 967 7ff6c6495eb7-7ff6c6495ec2 call 7ff6c6495598 959->967 979 7ff6c649605f-7ff6c6496066 966->979 980 7ff6c649606b-7ff6c649606e 966->980 967->966 973 7ff6c6495ec8-7ff6c6495ed3 call 7ff6c64955c8 967->973 973->966 978 7ff6c6495ed9-7ff6c6495efc call 7ff6c648a948 GetTimeZoneInformation 973->978 990 7ff6c6495f02-7ff6c6495f23 978->990 991 7ff6c6495fc4-7ff6c6495fee call 7ff6c6495580 call 7ff6c6495570 call 7ff6c6495578 978->991 982 7ff6c64960fb-7ff6c64960fe 979->982 983 7ff6c6496070 980->983 984 7ff6c64960a5-7ff6c64960b8 call 7ff6c648d5fc 980->984 987 7ff6c6496073 call 7ff6c6495e7c 982->987 988 7ff6c6496104-7ff6c649610c call 7ff6c6495c00 982->988 983->987 995 7ff6c64960c3-7ff6c64960de call 7ff6c6491578 984->995 996 7ff6c64960ba 984->996 1000 7ff6c6496078-7ff6c64960a4 call 7ff6c648a948 call 7ff6c647c550 987->1000 988->1000 997 7ff6c6495f2e-7ff6c6495f35 990->997 998 7ff6c6495f25-7ff6c6495f2b 990->998 1014 7ff6c64960e0-7ff6c64960e3 995->1014 1015 7ff6c64960e5-7ff6c64960f7 call 7ff6c648a948 995->1015 1001 7ff6c64960bc-7ff6c64960c1 call 7ff6c648a948 996->1001 1003 7ff6c6495f37-7ff6c6495f3f 997->1003 1004 7ff6c6495f49 997->1004 998->997 1001->983 1003->1004 1010 7ff6c6495f41-7ff6c6495f47 1003->1010 1008 7ff6c6495f4b-7ff6c6495fbf call 7ff6c649a4d0 * 4 call 7ff6c6492b5c call 7ff6c6496114 * 2 1004->1008 1008->991 1010->1008 1014->1001 1015->982
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495EAA
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C64955F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C649560C
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495EBB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6495598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C64955AC
                                                                                                                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF6C6495ECC
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C64955C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C64955DC
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A95E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A948: GetLastError.KERNEL32(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A968
                                                                                                                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6C649610C), ref: 00007FF6C6495EF3
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                                  • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                  • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                                  • Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                  • Instruction ID: ba2d1839ddcf0255c756f9236b8fdc6ea8f2425aa0033f318b7da66a3c9a0ed7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5351F632A0864286E716DF22D9815B97765FF88799F40C135EACDC3B96DF3EE4408748
                                                                                                                                                                                                                                                  Function 00007FF6C6479280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2295610775-0
                                                                                                                                                                                                                                                  • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                  • Instruction ID: 5dbef415feb6bf3dbd26ea3c96f3a12c8a44bb255f8345fa9eb159f919e47e23
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 78F0C222A1C74286F7A18F60B4997A67390AB84769F04C736DAED42AD4DF3DD049CB08
                                                                                                                                                                                                                                                  Function 00007FF6C6471950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 331 7ff6c6471950-7ff6c647198b call 7ff6c64745c0 334 7ff6c6471991-7ff6c64719d1 call 7ff6c6477f90 331->334 335 7ff6c6471c4e-7ff6c6471c72 call 7ff6c647c550 331->335 340 7ff6c6471c3b-7ff6c6471c3e call 7ff6c648004c 334->340 341 7ff6c64719d7-7ff6c64719e7 call 7ff6c64806d4 334->341 345 7ff6c6471c43-7ff6c6471c4b 340->345 346 7ff6c6471a08-7ff6c6471a24 call 7ff6c648039c 341->346 347 7ff6c64719e9-7ff6c6471a03 call 7ff6c6484f08 call 7ff6c6472910 341->347 345->335 353 7ff6c6471a26-7ff6c6471a40 call 7ff6c6484f08 call 7ff6c6472910 346->353 354 7ff6c6471a45-7ff6c6471a5a call 7ff6c6484f28 346->354 347->340 353->340 361 7ff6c6471a5c-7ff6c6471a76 call 7ff6c6484f08 call 7ff6c6472910 354->361 362 7ff6c6471a7b-7ff6c6471b05 call 7ff6c6471c80 * 2 call 7ff6c64806d4 call 7ff6c6484f44 354->362 361->340 375 7ff6c6471b0a-7ff6c6471b14 362->375 376 7ff6c6471b16-7ff6c6471b30 call 7ff6c6484f08 call 7ff6c6472910 375->376 377 7ff6c6471b35-7ff6c6471b4e call 7ff6c648039c 375->377 376->340 382 7ff6c6471b50-7ff6c6471b6a call 7ff6c6484f08 call 7ff6c6472910 377->382 383 7ff6c6471b6f-7ff6c6471b8b call 7ff6c6480110 377->383 382->340 391 7ff6c6471b8d-7ff6c6471b99 call 7ff6c6472710 383->391 392 7ff6c6471b9e-7ff6c6471bac 383->392 391->340 392->340 393 7ff6c6471bb2-7ff6c6471bb9 392->393 396 7ff6c6471bc1-7ff6c6471bc7 393->396 398 7ff6c6471bc9-7ff6c6471bd6 396->398 399 7ff6c6471be0-7ff6c6471bef 396->399 400 7ff6c6471bf1-7ff6c6471bfa 398->400 399->399 399->400 401 7ff6c6471bfc-7ff6c6471bff 400->401 402 7ff6c6471c0f 400->402 401->402 403 7ff6c6471c01-7ff6c6471c04 401->403 404 7ff6c6471c11-7ff6c6471c24 402->404 403->402 405 7ff6c6471c06-7ff6c6471c09 403->405 406 7ff6c6471c2d-7ff6c6471c39 404->406 407 7ff6c6471c26 404->407 405->402 408 7ff6c6471c0b-7ff6c6471c0d 405->408 406->340 406->396 407->406 408->404
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6477F90: _fread_nolock.LIBCMT ref: 00007FF6C647803A
                                                                                                                                                                                                                                                  • _fread_nolock.LIBCMT ref: 00007FF6C6471A1B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6C6471B6A), ref: 00007FF6C647295E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                                  • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                                  • Opcode ID: e8397b0d0ea8626c6fc67993dd962eb2185773315f76238df3ab4be19089fc6a
                                                                                                                                                                                                                                                  • Instruction ID: db9cfe08b533094ee5ceb4d7477df78db645f29699f59f5ce95e093536caf683
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e8397b0d0ea8626c6fc67993dd962eb2185773315f76238df3ab4be19089fc6a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37816F71A18686C5EB62DF24D0402BA33A1EF88746F44C436DACDC7796DE3EE545C748
                                                                                                                                                                                                                                                  Function 00007FF6C6471600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 409 7ff6c6471600-7ff6c6471611 410 7ff6c6471637-7ff6c6471651 call 7ff6c64745c0 409->410 411 7ff6c6471613-7ff6c647161c call 7ff6c6471050 409->411 416 7ff6c6471682-7ff6c647169c call 7ff6c64745c0 410->416 417 7ff6c6471653-7ff6c6471681 call 7ff6c6484f08 call 7ff6c6472910 410->417 418 7ff6c647162e-7ff6c6471636 411->418 419 7ff6c647161e-7ff6c6471629 call 7ff6c6472710 411->419 426 7ff6c64716b8-7ff6c64716cf call 7ff6c64806d4 416->426 427 7ff6c647169e-7ff6c64716b3 call 7ff6c6472710 416->427 419->418 434 7ff6c64716f9-7ff6c64716fd 426->434 435 7ff6c64716d1-7ff6c64716f4 call 7ff6c6484f08 call 7ff6c6472910 426->435 433 7ff6c6471821-7ff6c6471824 call 7ff6c648004c 427->433 443 7ff6c6471829-7ff6c647183b 433->443 436 7ff6c6471717-7ff6c6471737 call 7ff6c6484f44 434->436 437 7ff6c64716ff-7ff6c647170b call 7ff6c6471210 434->437 448 7ff6c6471819-7ff6c647181c call 7ff6c648004c 435->448 449 7ff6c6471739-7ff6c647175c call 7ff6c6484f08 call 7ff6c6472910 436->449 450 7ff6c6471761-7ff6c647176c 436->450 445 7ff6c6471710-7ff6c6471712 437->445 445->448 448->433 462 7ff6c647180f-7ff6c6471814 449->462 451 7ff6c6471802-7ff6c647180a call 7ff6c6484f30 450->451 452 7ff6c6471772-7ff6c6471777 450->452 451->462 455 7ff6c6471780-7ff6c64717a2 call 7ff6c648039c 452->455 464 7ff6c64717da-7ff6c64717e6 call 7ff6c6484f08 455->464 465 7ff6c64717a4-7ff6c64717bc call 7ff6c6480adc 455->465 462->448 472 7ff6c64717ed-7ff6c64717f8 call 7ff6c6472910 464->472 470 7ff6c64717c5-7ff6c64717d8 call 7ff6c6484f08 465->470 471 7ff6c64717be-7ff6c64717c1 465->471 470->472 471->455 474 7ff6c64717c3 471->474 477 7ff6c64717fd 472->477 474->477 477->451
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                                  • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                                  • Opcode ID: 7efa5df9256787d249526d0bd59650b0437ae4a7c3dc28480c0bb41e2e769eb3
                                                                                                                                                                                                                                                  • Instruction ID: 2f4835055d3b73d25258c09ae67bce6241f0cdfb88269c876bf30de2112668ed
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7efa5df9256787d249526d0bd59650b0437ae4a7c3dc28480c0bb41e2e769eb3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE51B061B18643C2EA12AF1195401BA3391BF94B9AF48C536EE8CC7792DF3EE545C348
                                                                                                                                                                                                                                                  Function 00007FF6C6478660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetTempPathW.KERNEL32(?,?,00000000,00007FF6C6473CBB), ref: 00007FF6C6478704
                                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00007FF6C6473CBB), ref: 00007FF6C647870A
                                                                                                                                                                                                                                                  • CreateDirectoryW.KERNELBASE(?,00000000,00007FF6C6473CBB), ref: 00007FF6C647874C
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478830: GetEnvironmentVariableW.KERNEL32(00007FF6C647388E), ref: 00007FF6C6478867
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6C6478889
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6488238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C6488251
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472810: MessageBoxW.USER32 ref: 00007FF6C64728EA
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                                  • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                                  • Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                  • Instruction ID: 35262f95452dd2f93bb157b2f2cfadfbfddbd74d2d907c2edb9b358a5537fcb7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DD41F721B1964248FA16EF65A9512F93391AF487C6F40C032DD8DC77E6EE3EE501C348
                                                                                                                                                                                                                                                  Function 00007FF6C6471210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 756 7ff6c6471210-7ff6c647126d call 7ff6c647bd80 759 7ff6c6471297-7ff6c64712af call 7ff6c6484f44 756->759 760 7ff6c647126f-7ff6c6471296 call 7ff6c6472710 756->760 765 7ff6c64712d4-7ff6c64712e4 call 7ff6c6484f44 759->765 766 7ff6c64712b1-7ff6c64712cf call 7ff6c6484f08 call 7ff6c6472910 759->766 772 7ff6c6471309-7ff6c647131b 765->772 773 7ff6c64712e6-7ff6c6471304 call 7ff6c6484f08 call 7ff6c6472910 765->773 778 7ff6c6471439-7ff6c647144e call 7ff6c647ba60 call 7ff6c6484f30 * 2 766->778 776 7ff6c6471320-7ff6c6471345 call 7ff6c648039c 772->776 773->778 784 7ff6c647134b-7ff6c6471355 call 7ff6c6480110 776->784 785 7ff6c6471431 776->785 793 7ff6c6471453-7ff6c647146d 778->793 784->785 792 7ff6c647135b-7ff6c6471367 784->792 785->778 794 7ff6c6471370-7ff6c6471398 call 7ff6c647a1c0 792->794 797 7ff6c647139a-7ff6c647139d 794->797 798 7ff6c6471416-7ff6c647142c call 7ff6c6472710 794->798 799 7ff6c6471411 797->799 800 7ff6c647139f-7ff6c64713a9 797->800 798->785 799->798 802 7ff6c64713ab-7ff6c64713b9 call 7ff6c6480adc 800->802 803 7ff6c64713d4-7ff6c64713d7 800->803 809 7ff6c64713be-7ff6c64713c1 802->809 804 7ff6c64713ea-7ff6c64713ef 803->804 805 7ff6c64713d9-7ff6c64713e7 call 7ff6c6499e30 803->805 804->794 808 7ff6c64713f5-7ff6c64713f8 804->808 805->804 811 7ff6c647140c-7ff6c647140f 808->811 812 7ff6c64713fa-7ff6c64713fd 808->812 813 7ff6c64713c3-7ff6c64713cd call 7ff6c6480110 809->813 814 7ff6c64713cf-7ff6c64713d2 809->814 811->785 812->798 815 7ff6c64713ff-7ff6c6471407 812->815 813->804 813->814 814->798 815->776
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                                  • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                                  • Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
                                                                                                                                                                                                                                                  • Instruction ID: ef0f3bb399a0486cb6d11b62cd5ddd4fe1ae5751303d06608b5186ec3b3020d3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C51F922A0864281E662AF11A4403BA7391FF85B96F48C135EECDC7BD5EF3DE505C748
                                                                                                                                                                                                                                                  Function 00007FF6C64736B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF6C6473804), ref: 00007FF6C64736E1
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C6473804), ref: 00007FF6C64736EB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C6473706,?,00007FF6C6473804), ref: 00007FF6C6472C9E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C6473706,?,00007FF6C6473804), ref: 00007FF6C6472D63
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472C50: MessageBoxW.USER32 ref: 00007FF6C6472D99
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                                  • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                                  • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                  • Instruction ID: 27eaa4ede51a19cc61983e1c7c9b2b5aa2253bd4d4b0732632e0587962cbdae9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 56219261B1C64291FB33AF24E8153BA3255BF8835AF80C236E6DDC65D5EE2EE504C748
                                                                                                                                                                                                                                                  Function 00007FF6C648BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 846 7ff6c648ba5c-7ff6c648ba82 847 7ff6c648ba84-7ff6c648ba98 call 7ff6c6484ee8 call 7ff6c6484f08 846->847 848 7ff6c648ba9d-7ff6c648baa1 846->848 866 7ff6c648be8e 847->866 850 7ff6c648be77-7ff6c648be83 call 7ff6c6484ee8 call 7ff6c6484f08 848->850 851 7ff6c648baa7-7ff6c648baae 848->851 869 7ff6c648be89 call 7ff6c648a8e0 850->869 851->850 852 7ff6c648bab4-7ff6c648bae2 851->852 852->850 855 7ff6c648bae8-7ff6c648baef 852->855 858 7ff6c648baf1-7ff6c648bb03 call 7ff6c6484ee8 call 7ff6c6484f08 855->858 859 7ff6c648bb08-7ff6c648bb0b 855->859 858->869 864 7ff6c648bb11-7ff6c648bb17 859->864 865 7ff6c648be73-7ff6c648be75 859->865 864->865 870 7ff6c648bb1d-7ff6c648bb20 864->870 867 7ff6c648be91-7ff6c648bea8 865->867 866->867 869->866 870->858 873 7ff6c648bb22-7ff6c648bb47 870->873 875 7ff6c648bb49-7ff6c648bb4b 873->875 876 7ff6c648bb7a-7ff6c648bb81 873->876 879 7ff6c648bb72-7ff6c648bb78 875->879 880 7ff6c648bb4d-7ff6c648bb54 875->880 877 7ff6c648bb83-7ff6c648bbab call 7ff6c648d5fc call 7ff6c648a948 * 2 876->877 878 7ff6c648bb56-7ff6c648bb6d call 7ff6c6484ee8 call 7ff6c6484f08 call 7ff6c648a8e0 876->878 911 7ff6c648bbc8-7ff6c648bbf3 call 7ff6c648c284 877->911 912 7ff6c648bbad-7ff6c648bbc3 call 7ff6c6484f08 call 7ff6c6484ee8 877->912 909 7ff6c648bd00 878->909 881 7ff6c648bbf8-7ff6c648bc0f 879->881 880->878 880->879 884 7ff6c648bc11-7ff6c648bc19 881->884 885 7ff6c648bc8a-7ff6c648bc94 call 7ff6c649391c 881->885 884->885 890 7ff6c648bc1b-7ff6c648bc1d 884->890 896 7ff6c648bd1e 885->896 897 7ff6c648bc9a-7ff6c648bcaf 885->897 890->885 894 7ff6c648bc1f-7ff6c648bc35 890->894 894->885 899 7ff6c648bc37-7ff6c648bc43 894->899 905 7ff6c648bd23-7ff6c648bd43 ReadFile 896->905 897->896 901 7ff6c648bcb1-7ff6c648bcc3 GetConsoleMode 897->901 899->885 903 7ff6c648bc45-7ff6c648bc47 899->903 901->896 908 7ff6c648bcc5-7ff6c648bccd 901->908 903->885 910 7ff6c648bc49-7ff6c648bc61 903->910 906 7ff6c648bd49-7ff6c648bd51 905->906 907 7ff6c648be3d-7ff6c648be46 GetLastError 905->907 906->907 913 7ff6c648bd57 906->913 916 7ff6c648be63-7ff6c648be66 907->916 917 7ff6c648be48-7ff6c648be5e call 7ff6c6484f08 call 7ff6c6484ee8 907->917 908->905 915 7ff6c648bccf-7ff6c648bcf1 ReadConsoleW 908->915 918 7ff6c648bd03-7ff6c648bd0d call 7ff6c648a948 909->918 910->885 919 7ff6c648bc63-7ff6c648bc6f 910->919 911->881 912->909 921 7ff6c648bd5e-7ff6c648bd73 913->921 923 7ff6c648bd12-7ff6c648bd1c 915->923 924 7ff6c648bcf3 GetLastError 915->924 928 7ff6c648bcf9-7ff6c648bcfb call 7ff6c6484e7c 916->928 929 7ff6c648be6c-7ff6c648be6e 916->929 917->909 918->867 919->885 927 7ff6c648bc71-7ff6c648bc73 919->927 921->918 932 7ff6c648bd75-7ff6c648bd80 921->932 923->921 924->928 927->885 936 7ff6c648bc75-7ff6c648bc85 927->936 928->909 929->918 938 7ff6c648bd82-7ff6c648bd9b call 7ff6c648b674 932->938 939 7ff6c648bda7-7ff6c648bdaf 932->939 936->885 946 7ff6c648bda0-7ff6c648bda2 938->946 942 7ff6c648bdb1-7ff6c648bdc3 939->942 943 7ff6c648be2b-7ff6c648be38 call 7ff6c648b4b4 939->943 947 7ff6c648be1e-7ff6c648be26 942->947 948 7ff6c648bdc5 942->948 943->946 946->918 947->918 950 7ff6c648bdca-7ff6c648bdd1 948->950 951 7ff6c648bdd3-7ff6c648bdd7 950->951 952 7ff6c648be0d-7ff6c648be18 950->952 953 7ff6c648bdf3 951->953 954 7ff6c648bdd9-7ff6c648bde0 951->954 952->947 955 7ff6c648bdf9-7ff6c648be09 953->955 954->953 956 7ff6c648bde2-7ff6c648bde6 954->956 955->950 957 7ff6c648be0b 955->957 956->953 958 7ff6c648bde8-7ff6c648bdf1 956->958 957->947 958->955
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                  • Instruction ID: fc83454745ad798bc3d4a0f3e74a2395c581143f6974aae153c54d30337fc3d3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FBC1E72290C78699E6629F1590402BE3791FF89B81F55C136EACDC37A1CF7EE445C788
                                                                                                                                                                                                                                                  Function 00007FF6C6478570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 995526605-0
                                                                                                                                                                                                                                                  • Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                  • Instruction ID: 3cd83527a174f5ebf25b26ddcc42f583e041a7c458cb14a8ea7367b0fdf67235
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E5219E31A1CA4246EB118F55B64022AB3A4EF857A5F50C235EAEC83AE4DE7ED546C704
                                                                                                                                                                                                                                                  Function 00007FF6C64790E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478570: GetCurrentProcess.KERNEL32 ref: 00007FF6C6478590
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478570: OpenProcessToken.ADVAPI32 ref: 00007FF6C64785A3
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478570: GetTokenInformation.KERNELBASE ref: 00007FF6C64785C8
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478570: GetLastError.KERNEL32 ref: 00007FF6C64785D2
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478570: GetTokenInformation.KERNELBASE ref: 00007FF6C6478612
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6C647862E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6478570: CloseHandle.KERNEL32 ref: 00007FF6C6478646
                                                                                                                                                                                                                                                  • LocalFree.KERNEL32(?,00007FF6C6473C55), ref: 00007FF6C647916C
                                                                                                                                                                                                                                                  • LocalFree.KERNEL32(?,00007FF6C6473C55), ref: 00007FF6C6479175
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                  • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                                  • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                                  • Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                                  • Instruction ID: 0abf4cd22a2cdb59775cc8c6325e6a2d8c8cbd4b99ade759e98b4cb429c700f9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 11215131A08B4245F612AF10E9156EA76A5FF88782F44C035EA8DD3796DF3ED905C744
                                                                                                                                                                                                                                                  Function 00007FF6C6477E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CreateDirectoryW.KERNELBASE(00000000,?,00007FF6C647352C,?,00000000,00007FF6C6473F23), ref: 00007FF6C6477F32
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CreateDirectory
                                                                                                                                                                                                                                                  • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                                  • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                                  • Opcode ID: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
                                                                                                                                                                                                                                                  • Instruction ID: 267853cb28e84e1deb8f5017ee5be9a46a072c63ee5f3918d1f47656cdecbe3b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C31C321619AC545FA228F20E8507EA7395EB84BE6F44C230EAAD87BC9DE2DD601C704
                                                                                                                                                                                                                                                  Function 00007FF6C648CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C648CF4B), ref: 00007FF6C648D07C
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C648CF4B), ref: 00007FF6C648D107
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 953036326-0
                                                                                                                                                                                                                                                  • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                  • Instruction ID: 46c9f4e5c62faafbc021561c848b69d2e47fa68f20c1175d813b800f6a58f3a9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C591E322E1965185F7629F6594402BD3BE0AF49B89F14C136DE8ED2AA4CF3ED442C744
                                                                                                                                                                                                                                                  Function 00007FF6C648F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4170891091-0
                                                                                                                                                                                                                                                  • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                  • Instruction ID: 838122c540cb60c96d8bfe84e6b2b505141f2a1c7a545b239aab7f9f27f4c178
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 95514472F046118BFB59CF6499612BC37A5AB083AAF10C236DD5EC2AF5DF39A402C340
                                                                                                                                                                                                                                                  Function 00007FF6C648577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2780335769-0
                                                                                                                                                                                                                                                  • Opcode ID: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
                                                                                                                                                                                                                                                  • Instruction ID: 72bba46ebf94bdd403498bbc5bb824c025615945a04d77bf768edd7a2c1f58d2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f2931e55a17fed7c801103cab28c1f7fd047901bf7fa79ea6702d423310ad099
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6B519A22E186418AFB99DF71D4503BD37A1AB48B9DF10C436DE8DCB6A9DF39D4908384
                                                                                                                                                                                                                                                  Function 00007FF6C6485628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1279662727-0
                                                                                                                                                                                                                                                  • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                  • Instruction ID: 699bdd84fb586f7e2aca47ccd13fc25c1cf4ff7807229c925fd8ed329aaee408
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E41A122D1878183E7559F2095103797760FBA87A9F10D336EADC83AE1DF7DA5E08784
                                                                                                                                                                                                                                                  Function 00007FF6C647CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3251591375-0
                                                                                                                                                                                                                                                  • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                  • Instruction ID: 90ca17e13603adf4c8ff34a3d05f9d66cf65f5cfb376fac841607093474e4893
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 96318D21E5C54749FA16AF6499123B93681AF8538AF45C035D9CEC72E7DE2FB804C34C
                                                                                                                                                                                                                                                  Function 00007FF6C648013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                                  • Instruction ID: 8e44e4a707b2fe172f9d87dd9181db9c94e8371d7a7947c40ae396bf9dd06c94
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D351FB21B2924186F7269D25940067A7681AF48FBBF08C636DDEDC37E5CF3ED8409748
                                                                                                                                                                                                                                                  Function 00007FF6C648C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2976181284-0
                                                                                                                                                                                                                                                  • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                  • Instruction ID: 8bd7184a655722c118972fa73a83a0cf4fabb9b3639818245482c1ac397c128b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 33110421718A8181DA218F25A84016A7761AB89FF5F54C332EEBD87BE8CF3DD0108B44
                                                                                                                                                                                                                                                  Function 00007FF6C6485924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C6485839), ref: 00007FF6C6485957
                                                                                                                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C6485839), ref: 00007FF6C648596D
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                                                                                                                  • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                  • Instruction ID: fb4b8a36654fe4040d3f9a569be5143998330e3f6807578ad0c1f6698cb85563
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94118F6160C612C2EAA58F14A41103AB760EB897B6F508236F6EDC19E8EF2ED054DB44
                                                                                                                                                                                                                                                  Function 00007FF6C648A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A95E
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A968
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 485612231-0
                                                                                                                                                                                                                                                  • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                  • Instruction ID: 4a421201bdd31ee48217457b0ce491c1e110b749fcdffd08f360b5c58287e47a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3AE04F10E5960282FF1BAFB2944517932515F8CB02F44C435C98DC22A1EE2E68818758
                                                                                                                                                                                                                                                  Function 00007FF6C648AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CloseHandle.KERNELBASE(?,?,?,00007FF6C648A9D5,?,?,00000000,00007FF6C648AA8A), ref: 00007FF6C648ABC6
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6C648A9D5,?,?,00000000,00007FF6C648AA8A), ref: 00007FF6C648ABD0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 918212764-0
                                                                                                                                                                                                                                                  • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                  • Instruction ID: 750c4e76436d3da246696b18f06bbb7b28b94ec05b33cf169f69b2be51a1b70c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DA21DB11F1C74641FA529F51945437D32929F8C796F04C236DB9EC77E2CEAEE4854348
                                                                                                                                                                                                                                                  Function 00007FF6C648BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                  • Instruction ID: 039585a80c4a783fefdeff7565ffe49cf22f5925c607893a4d0fc37de88035de
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4441D7369086458BEA368F19A54017973A1EB5DB42F14C132DBCEC36E1CF6EE442CB94
                                                                                                                                                                                                                                                  Function 00007FF6C6477F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _fread_nolock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 840049012-0
                                                                                                                                                                                                                                                  • Opcode ID: 0452e3aa7aca29920b4941156e71ee71ec49b143be23cefe434c899149b2eae9
                                                                                                                                                                                                                                                  • Instruction ID: fb533ee37e21b1144c695e1949bc59e5abbf87c245db03e20c21e03eae372d57
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0452e3aa7aca29920b4941156e71ee71ec49b143be23cefe434c899149b2eae9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8A21D631B196914AFA529F2265043BAB641BF4ABC5F89C431EF8C87786CE7EE041C308
                                                                                                                                                                                                                                                  Function 00007FF6C648B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                                  • Instruction ID: f08d22d3ad3305e3b84d0954854f675528ddd837a01021747f581b4722b1daca
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8C318222E1860289E713AF55844137D3690AF98B92F41C137EA9DC33E2DF7EA441C799
                                                                                                                                                                                                                                                  Function 00007FF6C6485F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                  • Instruction ID: 6febf06e5595b38cbb26bf99f861ea7f8ead4a45622dba0bae8c63fc620b8628
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7B119621A1C64181EAA6AF11940017DB3A1BF99B89F44C433EBCCD7AB6CF7ED4408788
                                                                                                                                                                                                                                                  Function 00007FF6C6496354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                  • Instruction ID: ec7d5431a8fbbf3bb0644662fcdf6fd6d4ba7380b0ecccfb32e52d0969aa8c77
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB21A432A18A4187EB628F28D54037977A4FB84B99F14C234EB9DC7AD9DF3ED4118B04
                                                                                                                                                                                                                                                  Function 00007FF6C64803BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                  • Instruction ID: a2d55805150cdb3fc1d5bd9fb315edeb4c37496498ce2e92218f1c7735faca80
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C6010821A5874140E605DF525900169B691BFD9FE2F48C232DEDCD3BE6CF3ED0118344
                                                                                                                                                                                                                                                  Function 00007FF6C648D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,?,00007FF6C6480C90,?,?,?,00007FF6C64822FA,?,?,?,?,?,00007FF6C6483AE9), ref: 00007FF6C648D63A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                                                  • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                  • Instruction ID: d3f8893b494611f6e9e045cf2051a672c6d72907477d9fe5c025f5b4a650403e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4CF05E10F0A20B81FE675F7159012B932D55F8C7B6F08D732DDAED52E1DE2EA4808398

                                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                                  Function 00007FF6C6475830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C6475840
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C6475852
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C6475889
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C647589B
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C64758B4
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C64758C6
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C64758DF
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C64758F1
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C647590D
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C647591F
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C647593B
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C647594D
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C6475969
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C647597B
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C6475997
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C64759A9
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C64759C5
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C64764CF,?,00007FF6C647336E), ref: 00007FF6C64759D7
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                  • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                                  • API String ID: 199729137-653951865
                                                                                                                                                                                                                                                  • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                  • Instruction ID: d7e59b7aee7d33b49a259f9f506e494862c8be620b719b0d78c6dae2001419c1
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F422C360A99B07C2FB0BDF55AA105B933A8AF4574BF85D035C49E86260FF3EB459C308
                                                                                                                                                                                                                                                  Function 00007FF6C64940AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                                  • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                                  • Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                  • Instruction ID: 63ba3de47ed7316cf7e198d503ff6ed3f0fb6886eec011bf4d5367abf8b70575
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61B2E572E582828BE7268E64D6407FD37A5FF4438EF50D135DA4D97A88DF3AA900CB44
                                                                                                                                                                                                                                                  Function 00007FF6C64783C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,00007FF6C6478919,00007FF6C6473FA5), ref: 00007FF6C647842B
                                                                                                                                                                                                                                                  • RemoveDirectoryW.KERNEL32(?,00007FF6C6478919,00007FF6C6473FA5), ref: 00007FF6C64784AE
                                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,00007FF6C6478919,00007FF6C6473FA5), ref: 00007FF6C64784CD
                                                                                                                                                                                                                                                  • FindNextFileW.KERNEL32(?,00007FF6C6478919,00007FF6C6473FA5), ref: 00007FF6C64784DB
                                                                                                                                                                                                                                                  • FindClose.KERNEL32(?,00007FF6C6478919,00007FF6C6473FA5), ref: 00007FF6C64784EC
                                                                                                                                                                                                                                                  • RemoveDirectoryW.KERNEL32(?,00007FF6C6478919,00007FF6C6473FA5), ref: 00007FF6C64784F5
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                                  • String ID: %s\*
                                                                                                                                                                                                                                                  • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                                  • Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                                  • Instruction ID: e3a74a0d41150e300c93e6ccffd5be52acfd1449777f5d272ee0d94bf6c38225
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9E41B531A1CA4299EA329F24E4441BA73A4FB94796F80C232DADDC36D4EF7ED549C704
                                                                                                                                                                                                                                                  Function 00007FF6C647ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                                                  • API String ID: 0-2665694366
                                                                                                                                                                                                                                                  • Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                  • Instruction ID: 7cd449427ce221a7de56b70417252e5bb1aa02db2afaaf4a1a5b62eb6c1d8731
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3852B272A146A68BD7A58F14D458B7E3BA9FB44342F01C139E68EC7780DF3AE944CB44
                                                                                                                                                                                                                                                  Function 00007FF6C647D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3140674995-0
                                                                                                                                                                                                                                                  • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                  • Instruction ID: fb2abdf7e8b82496416a81c076b91904fdd922a8182609534cf37701b6a593fd
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 99315472618B8186EB619F60E8843EE73A4FB84749F44C03ADA8E87B94DF7DD548C714
                                                                                                                                                                                                                                                  Function 00007FF6C648A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1239891234-0
                                                                                                                                                                                                                                                  • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                  • Instruction ID: c494943dd90e77a8733c37e752141b69542f13fc9da9816f0181cc96d787da8b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0231A232618B8186EB21CF24E8442EE33A4FB88759F508136EADD83B69DF3DD145CB04
                                                                                                                                                                                                                                                  Function 00007FF6C6491874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2227656907-0
                                                                                                                                                                                                                                                  • Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                  • Instruction ID: 000439ef76e9b7dff14c8a29f3554f9826018c886c2036d24a7e1bcf5dfee1c8
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2BB1E622B58692C1EA62DF2196001B973A5EB44BE9F44D132EEDD87BD5EF3EE441C304
                                                                                                                                                                                                                                                  Function 00007FF6C647D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2933794660-0
                                                                                                                                                                                                                                                  • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                  • Instruction ID: 1738ffd95fee26f657486f45659671566bb207aac5027832c2abfcb67a3c9fda
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 68117022B14F058AEB00CF70E8542B933A4FB59B59F044E31DEAD867A4DF3CD1558344
                                                                                                                                                                                                                                                  Function 00007FF6C6493C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy_s
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1502251526-0
                                                                                                                                                                                                                                                  • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                  • Instruction ID: 9a4800dc47be237cc693e6472e27fc5ce980788cd26359ff6c075578bce74165
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5CC12872B5828687DB26CF15E14466AB796FB95B89F44C134DB8E83744DF3EE800CB44
                                                                                                                                                                                                                                                  Function 00007FF6C647A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                                                  • API String ID: 0-1127688429
                                                                                                                                                                                                                                                  • Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                  • Instruction ID: 0ef955e36090272932bc24dba92c5369ef38ec192a948fdb36e5ff7465c16021
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5BF19672A143D58BE7A69F18C088B3A3AA9EF44745F06C538DA8DC7390DF3AE585C744
                                                                                                                                                                                                                                                  Function 00007FF6C6499728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 15204871-0
                                                                                                                                                                                                                                                  • Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                  • Instruction ID: ceef66103c2028e01a7dbcaec4c49f9884b532c5c223405917f410f96ba9660c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A3B16D73A14B898BEB1ACF29C94636837A4F744B4DF18C925DA9D837A4CF3AD451C704
                                                                                                                                                                                                                                                  Function 00007FF6C64839A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: $
                                                                                                                                                                                                                                                  • API String ID: 0-227171996
                                                                                                                                                                                                                                                  • Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                  • Instruction ID: 7b93238c4e9e6546d3693c237b504afb1072b72a840688fcde5e80374e7cc963
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49E1A572A0864285EB6B8E65805013D33A2FF48B49F14D137DB8EC76B5DF2BE851C788
                                                                                                                                                                                                                                                  Function 00007FF6C647A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                                                  • API String ID: 0-900081337
                                                                                                                                                                                                                                                  • Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                  • Instruction ID: ffdc6243072bbbf6307778a955077b6c0e9e4c97742566067130c271f040b6bc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AD919672A182C687E7A68F14C448B3E3AA9FF54355F11C139DA9EC6780CF3AE580CB44
                                                                                                                                                                                                                                                  Function 00007FF6C648DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: e+000$gfff
                                                                                                                                                                                                                                                  • API String ID: 0-3030954782
                                                                                                                                                                                                                                                  • Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                  • Instruction ID: b77a04ad5cf275d2a5ab38a9feb459ffb2a8449908e989c7eae22ef3bf5d84be
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 49516722B182D186E7268E359800B697B92F759B95F48C632CBDCCBAE5CF7ED441C704
                                                                                                                                                                                                                                                  Function 00007FF6C64908C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1010374628-0
                                                                                                                                                                                                                                                  • Opcode ID: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
                                                                                                                                                                                                                                                  • Instruction ID: b30fd3097e1446a080b0648c0d31dd935adbe264fc0deb5bbf1fc4aa4dee6dd3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7702EE21B5E64280FA57AF1196002793688AF45FABF05C639DEEDC63D2DE7FE4408348
                                                                                                                                                                                                                                                  Function 00007FF6C648DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: gfffffff
                                                                                                                                                                                                                                                  • API String ID: 0-1523873471
                                                                                                                                                                                                                                                  • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                  • Instruction ID: 93b81942c3f68d63b43cbb2976c79a36e047cbacf1917f2b3d80340bb64011f4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1AA14762A0A7C946EB22CF25A4007AD7BD1EB58B84F04C132DE8DC77A6DE3ED401C744
                                                                                                                                                                                                                                                  Function 00007FF6C6488794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: TMP
                                                                                                                                                                                                                                                  • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                                  • Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                  • Instruction ID: 1f19fcbc064b5ca95b21b558a8373512d5717a1e9255ad13b596ddd45f2cbd38
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9A51B611F0C70285FA66AF27590117A72916F48BD6F49C436DE8EC77E6EE3EE4424388
                                                                                                                                                                                                                                                  Function 00007FF6C6493480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: HeapProcess
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 54951025-0
                                                                                                                                                                                                                                                  • Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                  • Instruction ID: e618abd1fbf36663f259f88569ba855e65d94fa8dfcd1babe45e225ccaf1584a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EDB09220E17E02C2EA0B2F22AC8625932A9BF88702F98C138C18C80330DE3D24E55704
                                                                                                                                                                                                                                                  Function 00007FF6C64835A0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                  • Instruction ID: 8b51a768c1fad9dce32152a3e9585aeb2401ae8988ffbe6239329dcc94f5111b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3BD1C662A0864285EB7B8E69805023D3792AF09B49F14D236CF8DD77A5DF3FD845C788
                                                                                                                                                                                                                                                  Function 00007FF6C6479800 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                  • Instruction ID: 87b40285b250d4f1a9b48055d999591435e79bc12ba732fa49bf8ec4024276f2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 56C180762181E08BD28AEB29E47947A73E1F78930EB95806BEF87477C5CB3CA514D710
                                                                                                                                                                                                                                                  Function 00007FF6C6482C10 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                  • Instruction ID: 2282742d3dda8cbf19a008afebdcc31945d7665983b12d5d68e5302331d6ae11
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 05B13B7690C68585E7668F39C05427E3BA0EB49B49F24C136CA8EC73A6CF3AD441D7C8
                                                                                                                                                                                                                                                  Function 00007FF6C648E570 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                  • Instruction ID: 9c0323594ef8959448078a7c42efbdf3dde8324ee74179889c46e4bac38067f5
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2381F372A0C78186E775CF19944076A7A91FB89794F40C236DBCDCBBA9DE3EE4018B44
                                                                                                                                                                                                                                                  Function 00007FF6C6496418 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
                                                                                                                                                                                                                                                  • Instruction ID: f1fa692a3a7428871e64bd8bcc6315be25b01b9abb71d1e51755c3d2df8a0df6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 46611822E4C25246F7668E68921467D7688AF4077AF14C239D69DC3AD5DE7FEC00C708
                                                                                                                                                                                                                                                  Function 00007FF6C6481D54 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                  • Instruction ID: 20dcf2129f524e148ce28df592e903526a9b6bae6cfd15a2a9bdd39055eb38b9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8A515F76A18652C2E7668F29D04037833A1EB59B59F24C133DA8DD77A4CF3BE852C784
                                                                                                                                                                                                                                                  Function 00007FF6C6481944 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                  • Instruction ID: 40441838d328c29d3c4421cdae9cda20f49fe4ae08fdd1117d34ffccd46fcc82
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C3515076A18652C6E7268F29D04422937A0EB48B59F24C133CACDD77A4DF3BE857C784
                                                                                                                                                                                                                                                  Function 00007FF6C6482164 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                  • Instruction ID: d2386345e813f1e6175d3f8a1134ad4844e5573ec004a60afa6ea438e6212da3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FE517336A1C65182E7658F29C45026A37A1EB58B59F24C132CE8DD77A6CF3BE843C7C4
                                                                                                                                                                                                                                                  Function 00007FF6C6481740 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                  • Instruction ID: 153157e5af468ccafd63d6db8da82bb92af61aa1d6e1c1f675312c143bb384b6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3C514F36A18652C6E7268F29C04462937A1EB49B59F24C137CE8DD77A5CF3BE842C7C4
                                                                                                                                                                                                                                                  Function 00007FF6C6481F60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                  • Instruction ID: fbe7583172d5176d9f2640fa10668130eda2b7b3203cafddfc63954deb6645ac
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 36516E36A1865285E7268F29C05422937A1EB59B59F24C132CF8DD77A6CF3BE843C7C4
                                                                                                                                                                                                                                                  Function 00007FF6C6481B50 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                  • Instruction ID: 0f61a654e939ebe9f4a49eff0518c133101b8c493899d99d223ca8be1f7c4a17
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5E51AF76A18652C2E7268F29C04072837A0EB48B59F24C133CE8CD77A5DF3BE842C784
                                                                                                                                                                                                                                                  Function 00007FF6C6485D30 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                  • Instruction ID: a85f8b7fb1714fdf5342d02b27bdf23d7cf6347e3ac44b64694e5302588549f5
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B541C362C0974A05E9EF8E1808086B43AD09F1A7ABD58D2B6DDDDD73E3CC0F6986C345
                                                                                                                                                                                                                                                  Function 00007FF6C6489EA0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 485612231-0
                                                                                                                                                                                                                                                  • Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                  • Instruction ID: 99705b0ddf82e257524ce1aa0a76bc48b1d7833acdffb110a28f84948d759efb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 54412522718A5582EF08CF2AD92456973A1BB4DFC0B09D033EE5DD7B64DE3ED0428344
                                                                                                                                                                                                                                                  Function 00007FF6C64880E4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                                                                  • Instruction ID: d814faa5b7ab2ec7a544b3f0a1930e6eb74a17f1eac0a5ddd4516ca6e70d56ab
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E31D432709B4285E766AF25644012D7AD9AF88BE1F14C239EADDD3BE6DF3DD0018748
                                                                                                                                                                                                                                                  Function 00007FF6C6499570 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                  • Instruction ID: d47ce84314f677fae68eea99ee1e19de30e039f51577173769e39e4b11899137
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1F044717186958ADB9A8F69A40262A77D1F748385F84D039D6CDC3E04DE3D90618F08
                                                                                                                                                                                                                                                  Function 00007FF6C647D30C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                                  • Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                  • Instruction ID: 6325023726c2ea524c66662ad531fe5e8d964728eb3940dc67d1ed593b71668e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F6A00221D6CC0AD0E6468F00EA9407633B4FB54706B80C032E08DE54B49F3EB404D308
                                                                                                                                                                                                                                                  Function 00007FF6C64776C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                  • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                                  • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                                  • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                  • Instruction ID: 668189b41288b5e47487bd5ea095b2c38b2e5959edc8c36e6bfcd2f2308ebcd6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D402C520A99F07D1FB179F65AB105B933A9AF4575BF80D031C4AE82264EF3EB159C308
                                                                                                                                                                                                                                                  Function 00007FF6C64781D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6479390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6C64745F4,00000000,00007FF6C6471985), ref: 00007FF6C64793C9
                                                                                                                                                                                                                                                  • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6C64786B7,?,?,00000000,00007FF6C6473CBB), ref: 00007FF6C647822C
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472810: MessageBoxW.USER32 ref: 00007FF6C64728EA
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                                  • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                                  • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                                  • Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                  • Instruction ID: c0267b87100b795de42de98d9bf34b8711252ef3d3e90563b189d9697a66cb9b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E51B721A2CA4245FB52AF25E9516FA3394EF94787F44C431D68EC2AD5EE3FE404C348
                                                                                                                                                                                                                                                  Function 00007FF6C6472180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                                  • String ID: P%
                                                                                                                                                                                                                                                  • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                                  • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                  • Instruction ID: fe5960a140753e40490dd87bf21413070ed51482ff68e3c709d4f1cbc05a0c46
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AB512726618BA186D6349F22E4181BBB7A1F798B66F008131EFDE83694DF3DD045DB14
                                                                                                                                                                                                                                                  Function 00007FF6C64780C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                                  • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                                  • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                                  • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                  • Instruction ID: d8b3fb521f3608810cdf940fc1ee1d3ef1ffb694535e6b26f8c5984153468876
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AC21B431B18A4282EB538F7AAA4417A7654EF89F96F08C230DEADC3394DE2DD5508309
                                                                                                                                                                                                                                                  Function 00007FF6C6486290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: -$:$f$p$p
                                                                                                                                                                                                                                                  • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                                  • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                  • Instruction ID: cc10a4d41df1783ef8a93802f70f6c12f57fed1d8941c0123a749af69a5a3619
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3D12D661E0D28386FBA2AF14D1146797691FB48752F84C137D6CDC66E4DF3EE5808B88
                                                                                                                                                                                                                                                  Function 00007FF6C6480FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: f$f$p$p$f
                                                                                                                                                                                                                                                  • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                                  • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                  • Instruction ID: c331fadb81d791ee6b09d0cfab3344feb45c0611d9e78abd9c8913505c1523ff
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D5127161E0C283C6FB215E14A04467976A1FB98755F84C137D6DEC79E4DF7EE8808B88
                                                                                                                                                                                                                                                  Function 00007FF6C6471050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                  • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                  • Opcode ID: 9e6d356331cceb36e06eccad6adf1a3c001823f33e5e99eafa3b8aac7d5c78d7
                                                                                                                                                                                                                                                  • Instruction ID: 3ddbbf229bbdda3b0ed4523a55d530bf87d0c0ffaca447d6df69817ad11a9acc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9e6d356331cceb36e06eccad6adf1a3c001823f33e5e99eafa3b8aac7d5c78d7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0D41C621B18652C1EA12EF11A8005BA7795FF59BC6F58C432EE8CCB795DE3EE505C348
                                                                                                                                                                                                                                                  Function 00007FF6C6471470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                  • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                  • Opcode ID: 1f9944f3975ec637b67728bc3c41dfd727d4deabf5f38a4d76f85a3f7c038b2f
                                                                                                                                                                                                                                                  • Instruction ID: 97e75146680269b543ce9d7abee77d62c3ba6486f618ea03006fd3641f642cce
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1f9944f3975ec637b67728bc3c41dfd727d4deabf5f38a4d76f85a3f7c038b2f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6D41B121B18642C6EB16DF21A5005BA7390FF58789F48C532EE8DD7B95DE3EE501C748
                                                                                                                                                                                                                                                  Function 00007FF6C647EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                                                                                                                  • API String ID: 849930591-393685449
                                                                                                                                                                                                                                                  • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                  • Instruction ID: 0e4322d8445d8d2ec61f5c5e8a9d7ab6c9084d28deef6d89e15a2d5dde9114c6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CAD19132A087458AEB22DF25D4407AD77A0FB45789F10C635DE8D97B96CF3AE482C748
                                                                                                                                                                                                                                                  Function 00007FF6C648ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF6C648F0AA,?,?,000001F951436BE8,00007FF6C648AD53,?,?,?,00007FF6C648AC4A,?,?,?,00007FF6C6485F3E), ref: 00007FF6C648EE8C
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF6C648F0AA,?,?,000001F951436BE8,00007FF6C648AD53,?,?,?,00007FF6C648AC4A,?,?,?,00007FF6C6485F3E), ref: 00007FF6C648EE98
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                                  • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                                  • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                  • Instruction ID: 6ff2a35c52d442f6f6c9d2e96a4f713d0d53525fe038c356a4e1b0e643b94c61
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 98410621B19A1241EB17DF169900A753295BF49B92F88C536DD9DCB3A4EF3EE4068348
                                                                                                                                                                                                                                                  Function 00007FF6C6472C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C6473706,?,00007FF6C6473804), ref: 00007FF6C6472C9E
                                                                                                                                                                                                                                                  • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C6473706,?,00007FF6C6473804), ref: 00007FF6C6472D63
                                                                                                                                                                                                                                                  • MessageBoxW.USER32 ref: 00007FF6C6472D99
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                                  • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                  • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                                  • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                  • Instruction ID: 0f5460f5d14517269a276842ad69161f4ece93c4651623002eaa6db746b0a02b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9231F822708B4142E721AF25B9106AB7695BF88B9AF41C136EF8DD3759DF3DD506C304
                                                                                                                                                                                                                                                  Function 00007FF6C647DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF6C647DF7A,?,?,?,00007FF6C647DC6C,?,?,?,00007FF6C647D869), ref: 00007FF6C647DD4D
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6C647DF7A,?,?,?,00007FF6C647DC6C,?,?,?,00007FF6C647D869), ref: 00007FF6C647DD5B
                                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF6C647DF7A,?,?,?,00007FF6C647DC6C,?,?,?,00007FF6C647D869), ref: 00007FF6C647DD85
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF6C647DF7A,?,?,?,00007FF6C647DC6C,?,?,?,00007FF6C647D869), ref: 00007FF6C647DDF3
                                                                                                                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF6C647DF7A,?,?,?,00007FF6C647DC6C,?,?,?,00007FF6C647D869), ref: 00007FF6C647DDFF
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                                                                                                                  • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                                  • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                  • Instruction ID: 3df56e7669ea2db4eb2da5229985ea0128ce3289c435fd335b0f9313f7eb8d89
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9631BE21B2A64291EE539F02A9005A533D8FF48BA6F49C535EDAD86380EE3EE444C70C
                                                                                                                                                                                                                                                  Function 00007FF6C6476360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                                  • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                                  • Opcode ID: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
                                                                                                                                                                                                                                                  • Instruction ID: c42a39f4658a5f13c7b853550fdc7dcc0d361c1837a0a3dd550dabd3a764d2c4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3F418031A1CA8691EA16DF20E5141EA7365FF44386F90C132DADC83696EF3DE609C748
                                                                                                                                                                                                                                                  Function 00007FF6C6472A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6C647351A,?,00000000,00007FF6C6473F23), ref: 00007FF6C6472AA0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                  • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                                  • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                  • Instruction ID: e5a9ba1261afab27dead6fbdf0eb359b9e8bf1fb112ccf8620a838febe585a08
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2621AE32A18B8182E7229F60B8817E67394FB88785F408136EECC93759DF3DD245C744
                                                                                                                                                                                                                                                  Function 00007FF6C648B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                                                  • Opcode ID: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
                                                                                                                                                                                                                                                  • Instruction ID: e007111aa4d464074df368ec77215fe4394a92c0f9eb746c813361e8b6b54494
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9F217F20B0C34285F6676F219A5113975425F497F2F04C736D9BECABE6DE2EA4418389
                                                                                                                                                                                                                                                  Function 00007FF6C6497D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                                  • String ID: CONOUT$
                                                                                                                                                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                                  • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                  • Instruction ID: b8a0051f2bc17c60437e21595c52f9487cebcd50973c77d25ab91fbcef53d559
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4D11B121A18A4186E7518F12F95972A76A4FB88FE9F00C234EA9DC77A4DF3DD8108708
                                                                                                                                                                                                                                                  Function 00007FF6C6478ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6C6473FB1), ref: 00007FF6C6478EFD
                                                                                                                                                                                                                                                  • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6C6473FB1), ref: 00007FF6C6478F5A
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6479390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6C64745F4,00000000,00007FF6C6471985), ref: 00007FF6C64793C9
                                                                                                                                                                                                                                                  • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6C6473FB1), ref: 00007FF6C6478FE5
                                                                                                                                                                                                                                                  • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6C6473FB1), ref: 00007FF6C6479044
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6C6473FB1), ref: 00007FF6C6479055
                                                                                                                                                                                                                                                  • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6C6473FB1), ref: 00007FF6C647906A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3462794448-0
                                                                                                                                                                                                                                                  • Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                  • Instruction ID: c581e508153a72a50d053a1862e22137419aecf910e0120cc1be703fde280b8a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5741B562A296C285EA319F12A5002BA73A4FF85BD6F45C135DFCD97789DE3ED500C708
                                                                                                                                                                                                                                                  Function 00007FF6C648B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6C6484F11,?,?,?,?,00007FF6C648A48A,?,?,?,?,00007FF6C648718F), ref: 00007FF6C648B2D7
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C6484F11,?,?,?,?,00007FF6C648A48A,?,?,?,?,00007FF6C648718F), ref: 00007FF6C648B30D
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C6484F11,?,?,?,?,00007FF6C648A48A,?,?,?,?,00007FF6C648718F), ref: 00007FF6C648B33A
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C6484F11,?,?,?,?,00007FF6C648A48A,?,?,?,?,00007FF6C648718F), ref: 00007FF6C648B34B
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C6484F11,?,?,?,?,00007FF6C648A48A,?,?,?,?,00007FF6C648718F), ref: 00007FF6C648B35C
                                                                                                                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF6C6484F11,?,?,?,?,00007FF6C648A48A,?,?,?,?,00007FF6C648718F), ref: 00007FF6C648B377
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                                                                                                                  • Opcode ID: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
                                                                                                                                                                                                                                                  • Instruction ID: 6d67dffd24bfefc8061419588b8c0fadc0afebee328bdb799b5190c916cd426e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 06114F20B0C74286F6576F21565113D31429F4DBF2F04C736D9BED6AE6DE2EE8418349
                                                                                                                                                                                                                                                  Function 00007FF6C6472910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6C6471B6A), ref: 00007FF6C647295E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                  • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                                  • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                  • Instruction ID: 2d093d5a310bc16cc47a24bd81c62eaf57efc20d68f466abd3b73deafeb55080
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5231FF22B1868196E722AB61A8402E77294BF887DAF40C132EECCC3759EF3DD146C344
                                                                                                                                                                                                                                                  Function 00007FF6C6472390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                                  • String ID: Unhandled exception in script
                                                                                                                                                                                                                                                  • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                                  • Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                  • Instruction ID: f85734653b9ba66f3f4b70cc0dcdbe4b6bc884fd270d39a94c03c7cb19bd929c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 18319032619A8288EB21DF61E8552FA7360FF88789F408136EA8D87B59DF3DD144C704
                                                                                                                                                                                                                                                  Function 00007FF6C6472B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6C647918F,?,00007FF6C6473C55), ref: 00007FF6C6472BA0
                                                                                                                                                                                                                                                  • MessageBoxW.USER32 ref: 00007FF6C6472C2A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                                  • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                                  • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                                  • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                  • Instruction ID: 6659714d55b1a99d4bd1696837cac1f779f20f6a73050ec9d40fc0d89fc7fc17
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0D21AE62B18B4192E7129F24F8847EA73A4FB88785F40C136EE8D9775AEE3DD205C744
                                                                                                                                                                                                                                                  Function 00007FF6C6472710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6C6471B99), ref: 00007FF6C6472760
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                  • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                                  • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                  • Instruction ID: 78cb5714c31c1adfd9939ff741403fbd4d2cb429508b05c01bfd7a052035e359
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 56218E32A18B8192E7229F50B9817E673A4FB88785F408136EECC93759DF7DD245C744
                                                                                                                                                                                                                                                  Function 00007FF6C6489A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                  • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                  • Instruction ID: 4341559a420e43caf234085cbd35ca3598556b0d5260c2ea69c2f09513055b3f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1F0AF21B19A0681EA118F24A48533A3320AF497A6F48C236CAAEC66F4CF2ED044D348
                                                                                                                                                                                                                                                  Function 00007FF6C6499368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _set_statfp
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1156100317-0
                                                                                                                                                                                                                                                  • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                  • Instruction ID: 6cd126ac73cae5617474c7ffdbad5f0a1d7cd5a1c4fa6130b90c6751bd8e8cab
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4111B632DDCA4301F6761D75E6913793048AF5C36DE0CC634EAEEC6AD68E6E64814308
                                                                                                                                                                                                                                                  Function 00007FF6C648B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF6C648A5A3,?,?,00000000,00007FF6C648A83E,?,?,?,?,?,00007FF6C648A7CA), ref: 00007FF6C648B3AF
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C648A5A3,?,?,00000000,00007FF6C648A83E,?,?,?,?,?,00007FF6C648A7CA), ref: 00007FF6C648B3CE
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C648A5A3,?,?,00000000,00007FF6C648A83E,?,?,?,?,?,00007FF6C648A7CA), ref: 00007FF6C648B3F6
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C648A5A3,?,?,00000000,00007FF6C648A83E,?,?,?,?,?,00007FF6C648A7CA), ref: 00007FF6C648B407
                                                                                                                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF6C648A5A3,?,?,00000000,00007FF6C648A83E,?,?,?,?,?,00007FF6C648A7CA), ref: 00007FF6C648B418
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Value
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                                                                                                                  • Opcode ID: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
                                                                                                                                                                                                                                                  • Instruction ID: 07cd26769b9e268b30a14fc2dcb64d4a7ccbf37a7c560573386778494287cbaf
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6211B420F0C70285F9979F25555153931415F8D7F2F48C336D8BDC6AE6DE2EE4428349
                                                                                                                                                                                                                                                  Function 00007FF6C648B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Value
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                                                                                                                  • Opcode ID: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
                                                                                                                                                                                                                                                  • Instruction ID: 60989f15cefc20498ae3112e7a2c1f49ca5f1c7f49145bfc5cd9d6d923333e2e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BD110620A0930789F99B6F6148555B931424F4E372F04CB36D9BEDA6F3DD2EB4419389
                                                                                                                                                                                                                                                  Function 00007FF6C6485FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: verbose
                                                                                                                                                                                                                                                  • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                                  • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                  • Instruction ID: 033932eaff6ca1341b3284b34aec8547a62f8c4ed07a4c64d904648c68e01e4f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 73911432A0864681F7A29E24D4507BD3B91AB49B56F44C133DADDC33E6DF3EE8458388
                                                                                                                                                                                                                                                  Function 00007FF6C648FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                                  • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                                  • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                  • Instruction ID: 72f7d83770e291b4c3f2d4a47ef351cf4ccb2a43d0f3522f1725feb3ac4ef382
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C681C672E0824385F7E75E29811027936E0AB197C5F55C037CB8ED76A6DF2FE9019389
                                                                                                                                                                                                                                                  Function 00007FF6C647D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                                                                  • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                                  • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                  • Instruction ID: 94b807774ef0b41f961766dc56d8662dfbd3ee23d27e825d95f4c2a70c876522
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FE51C032B296028ADB16DF15E444A7877E1FB44B99F11C131DA9E87788EF7EE841C708
                                                                                                                                                                                                                                                  Function 00007FF6C647EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                                  • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                  • Instruction ID: 089775a0f8d6355e228022b64d2f88d9f871dec445a4b821fed19215576aff42
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C2619F72908BC585DB618F15E4407AABBA0FB85789F04C625EBDC83B95CF7DD091CB04
                                                                                                                                                                                                                                                  Function 00007FF6C647F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                                  • String ID: csm$csm
                                                                                                                                                                                                                                                  • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                                  • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                  • Instruction ID: c6518294b0dd62da391a09d9385307db917e8a404136310b929d9e5a91af3449
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1C519F32A083828AEBB58F21D54426877A4FB55B86F14C136DADC87BC5CF3EE451C709
                                                                                                                                                                                                                                                  Function 00007FF6C6472810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Message
                                                                                                                                                                                                                                                  • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                                  • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                                  • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                  • Instruction ID: 9de6f885d80b18cf9cc4b6bcfb64781d3ed6345e39f12bfcc3d2b048c7dc6c53
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D0219C62B18B4192E7229F14B8447EA73A4EB88785F40C136EA8D9375AEE3DD245C744
                                                                                                                                                                                                                                                  Function 00007FF6C648C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2718003287-0
                                                                                                                                                                                                                                                  • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                  • Instruction ID: b4d82c22a1b70620c7a397321ceac184934fac99a332b6d227bb22d3d5cbcdf2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 03D10472B18A818AE712CF75D4402AC37B1FB58B99B44C236DE9DD7B99DE39D006C348
                                                                                                                                                                                                                                                  Function 00007FF6C64720C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1956198572-0
                                                                                                                                                                                                                                                  • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                  • Instruction ID: d03a412f81342b67eadf1f8da630fe963cc9665e3153530f295e06ee989efb70
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C311E921A1C14282F6568F69E64427B7792FB85786F48C030DBCD47B8ACD2FD495D708
                                                                                                                                                                                                                                                  Function 00007FF6C6495B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: ?
                                                                                                                                                                                                                                                  • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                                  • Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                  • Instruction ID: 6d62bc2e96296627a2bec238968b39faf056fb20e6a8ef6715dc03821b29ff67
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4A412C12A0834245FB6A9F25D6013797764EB80BA9F24C235EFDC87AD5DF3ED4418704
                                                                                                                                                                                                                                                  Function 00007FF6C6489014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C6489046
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A95E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C648A948: GetLastError.KERNEL32(?,?,?,00007FF6C6492D22,?,?,?,00007FF6C6492D5F,?,?,00000000,00007FF6C6493225,?,?,?,00007FF6C6493157), ref: 00007FF6C648A968
                                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6C647CBA5), ref: 00007FF6C6489064
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: C:\Users\user\Desktop\zed.exe
                                                                                                                                                                                                                                                  • API String ID: 3580290477-2481037355
                                                                                                                                                                                                                                                  • Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                  • Instruction ID: b741e047c98816d93687c0778ff7835f553f06c6974f667a37d7f67a86ea22f4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4E417136A0CB0285E716AF25D8400BD7795EF897D5B55C036EA8DC3BA5DE3EE4818388
                                                                                                                                                                                                                                                  Function 00007FF6C648CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                                  • String ID: U
                                                                                                                                                                                                                                                  • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                                  • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                  • Instruction ID: 1d70fc78bd1c32ff5f04a73edbe9afe118cb34c0efdd3e6890fbe2fae82f3351
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3B41B232B18A4186DB219F25E4443AA77A4FB88B85F40C136EE8DC7798EF3DD401C744
                                                                                                                                                                                                                                                  Function 00007FF6C648F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentDirectory
                                                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                                                  • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                                  • Opcode ID: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
                                                                                                                                                                                                                                                  • Instruction ID: 6be53d518009e33c2687e832c57a36cfc4e7c6727a643c984f3e81a4832a70eb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 45210662A1864181EB629F11D04426D73A1FB8CB85F86C236D6CDD32A4DF7EE546CB84
                                                                                                                                                                                                                                                  Function 00007FF6C647FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                                  • String ID: csm
                                                                                                                                                                                                                                                  • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                                  • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                  • Instruction ID: b0349aaca432da99995c40ff6da98a5cfc19ba1b70e8939f0689e749ef0488a6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42112E32618B8182EB628F15E54425A77E4FB88B89F588230DBCD47754DF3DD551CB04
                                                                                                                                                                                                                                                  Function 00007FF6C649073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000006.00000002.2541936707.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2541844536.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542054254.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542166206.00007FF6C64B2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000006.00000002.2542315709.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_6_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID: :
                                                                                                                                                                                                                                                  • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                                  • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                  • Instruction ID: 3f9af5c313fa6955c742e6dd30aaf9cfcc9a0452b80bbfabb449897e95b0222b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A001842191C20285F722AF60946127E33A4EF89B5AF80C03AD68DC2691DF2ED504CB1C

                                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                                  Execution Coverage:9.3%
                                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                  Signature Coverage:0.5%
                                                                                                                                                                                                                                                  Total number of Nodes:1680
                                                                                                                                                                                                                                                  Total number of Limit Nodes:177
                                                                                                                                                                                                                                                  execution_graph 37754 7ff81f4a9ad0 37755 7ff81f4a9ae6 37754->37755 37757 7ff81f4a9b24 37755->37757 37758 7ff81f514170 37755->37758 37759 7ff81f5141bb 37758->37759 37760 7ff81f514197 37758->37760 37759->37757 37760->37759 37761 7ff81f5141bd 37760->37761 37762 7ff81f5141b3 37760->37762 37772 7ff81f45cf40 ShowWindow 37761->37772 37765 7ff81f45f200 37762->37765 37766 7ff81f45f22d 37765->37766 37769 7ff81f45f23a 37766->37769 37774 7ff81f45d690 37766->37774 37768 7ff81f45f243 37768->37759 37769->37768 37771 7ff81f45f2a3 ShowWindow 37769->37771 37771->37768 37773 7ff81f45cf91 37772->37773 37773->37759 37776 7ff81f45d6bb 37774->37776 37775 7ff81f45d80d 37775->37769 37776->37775 37777 7ff81f45d735 GetModuleHandleW 37776->37777 37778 7ff81f45d744 37776->37778 37777->37778 37779 7ff81f45d76b GetModuleHandleW 37778->37779 37780 7ff81f45d77a LoadIconW 37778->37780 37783 7ff81f45d791 37778->37783 37779->37780 37782 7ff81f45d7eb LoadCursorW RegisterClassW 37780->37782 37781 7ff81f45d856 37781->37769 37782->37775 37783->37781 37783->37782 37784 7ff81f2f1830 37785 7ff81f2f1882 37784->37785 37792 7ff81f2f3660 37785->37792 37787 7ff81f2f18fe 37788 7ff81f2f19a6 37787->37788 37789 7ff81f2f19a8 strncmp 37787->37789 37790 7ff81f2f1a8a 37787->37790 37791 7ff81f2f3660 31 API calls 37788->37791 37789->37788 37791->37790 37793 7ff81f2f369e 37792->37793 37797 7ff81f2f36d5 37792->37797 37794 7ff81f2f36d0 37793->37794 37795 7ff81f2f3791 37793->37795 37805 7ff81f3a0280 37794->37805 37795->37797 37798 7ff81f2f391f 37795->37798 37801 7ff81f2f38c2 37795->37801 37816 7ff81f39ff60 24 API calls 37795->37816 37797->37787 37818 7ff81f35e8d0 31 API calls 37798->37818 37800 7ff81f2f3945 37819 7ff81f39ff60 24 API calls 37800->37819 37817 7ff81f39ff60 24 API calls 37801->37817 37806 7ff81f3a028d TlsAlloc 37805->37806 37807 7ff81f3a02ac TlsGetValue 37805->37807 37806->37807 37809 7ff81f3a02d7 37807->37809 37810 7ff81f3a02c9 GetLastError 37807->37810 37815 7ff81f3a02e1 37809->37815 37820 7ff81f39fc10 37809->37820 37810->37809 37812 7ff81f3a039d 37812->37797 37813 7ff81f3a0361 LeaveCriticalSection 37813->37812 37814 7ff81f3a0377 GetProcessHeap HeapAlloc 37813->37814 37814->37812 37815->37812 37815->37813 37816->37795 37817->37797 37818->37800 37819->37797 37821 7ff81f39fd49 37820->37821 37822 7ff81f39fc2d 37820->37822 37825 7ff81f39fdd1 37821->37825 37826 7ff81f39fd56 GetProcessHeap HeapAlloc 37821->37826 37823 7ff81f39fc36 InitializeCriticalSection 37822->37823 37824 7ff81f39fc4d 37822->37824 37823->37824 37829 7ff81f39fc67 malloc 37824->37829 37830 7ff81f39fd3c LeaveCriticalSection 37824->37830 37825->37815 37827 7ff81f39fd75 memset 37826->37827 37828 7ff81f39fde4 37826->37828 37832 7ff81f3dfa00 37827->37832 37838 7ff81f39fdf1 37828->37838 37831 7ff81f39fc7e InitializeCriticalSection malloc 37829->37831 37829->37838 37830->37821 37833 7ff81f39fca9 InitializeCriticalSection 37831->37833 37831->37838 37834 7ff81f39fd91 LeaveCriticalSection GetCurrentThreadId TlsSetValue 37832->37834 37835 7ff81f39fcd0 malloc 37833->37835 37834->37825 37834->37838 37837 7ff81f39fd20 InitializeCriticalSection 37835->37837 37835->37838 37837->37830 37837->37835 37839 7ff81f39fe21 TlsAlloc 37838->37839 37840 7ff81f39fe40 TlsGetValue 37839->37840 37844 7ff81f39ff44 37839->37844 37842 7ff81f39fe6b 37840->37842 37843 7ff81f39fe5d GetLastError 37840->37843 37845 7ff81f39fe94 GetProcessHeap HeapAlloc 37842->37845 37843->37842 37843->37844 37846 7ff81f39feb7 37845->37846 37846->37815 37847 7ff81f4660d4 37850 7ff81f4660dd 37847->37850 37854 7ff81f4661d1 37847->37854 37848 7ff81f466200 DefWindowProcW 37849 7ff81f466213 37848->37849 37850->37849 37851 7ff81f4661b6 SendMessageW 37850->37851 37853 7ff81f46615f 37850->37853 37850->37854 37851->37849 37852 7ff81f4661cc 37851->37852 37852->37853 37853->37849 37853->37854 37855 7ff81f4661a0 SetFocus 37853->37855 37854->37848 37854->37849 37855->37849 37856 7ff81f345d80 37859 7ff81f345db3 37856->37859 37857 7ff81f345db8 37858 7ff81f345e4a 37860 7ff81f345e5d 37858->37860 37864 7ff81f345eed 37858->37864 37859->37857 37859->37858 37861 7ff81f345ddd 37859->37861 37862 7ff81f345de6 _errno 37859->37862 37863 7ff81f3a0280 25 API calls 37860->37863 37866 7ff81f345e67 37860->37866 37861->37862 37867 7ff81f345df7 37861->37867 37862->37867 37863->37866 37865 7ff81f3a0280 25 API calls 37864->37865 37864->37867 37868 7ff81f345f1b 37865->37868 37869 7ff81f345f8b 37868->37869 37872 7ff81f353730 31 API calls 37868->37872 37869->37867 37873 7ff81f39ff60 24 API calls 37869->37873 37872->37869 37873->37867 37874 7ff81f451ed0 37875 7ff81f451f0d 37874->37875 37876 7ff81f451f11 memset SystemParametersInfoW 37874->37876 37875->37876 37877 7ff81f451f47 CreateFontIndirectW 37876->37877 37878 7ff81f452083 SystemParametersInfoW 37876->37878 37903 7ff81f451e00 37877->37903 37879 7ff81f4520d0 6 API calls 37878->37879 37880 7ff81f4520a2 CreateFontIndirectW 37878->37880 37883 7ff81f451e00 22 API calls 37879->37883 37884 7ff81f451e00 22 API calls 37880->37884 37882 7ff81f451f6c DeleteObject CreateFontIndirectW 37886 7ff81f451e00 22 API calls 37882->37886 37887 7ff81f452180 DeleteObject 37883->37887 37885 7ff81f4520c4 DeleteObject 37884->37885 37885->37879 37888 7ff81f451f9a DeleteObject CreateFontIndirectW 37886->37888 37893 7ff81f4521c5 37887->37893 37895 7ff81f452193 37887->37895 37889 7ff81f451e00 22 API calls 37888->37889 37891 7ff81f451fc8 DeleteObject CreateFontIndirectW 37889->37891 37890 7ff81f4521a0 GetStockObject 37892 7ff81f451e00 22 API calls 37890->37892 37894 7ff81f451e00 22 API calls 37891->37894 37892->37895 37896 7ff81f451ff6 DeleteObject CreateFontIndirectW 37894->37896 37895->37890 37895->37893 37897 7ff81f451e00 22 API calls 37896->37897 37898 7ff81f452024 DeleteObject CreateFontIndirectW 37897->37898 37899 7ff81f451e00 22 API calls 37898->37899 37900 7ff81f45204f DeleteObject CreateFontIndirectW 37899->37900 37901 7ff81f451e00 22 API calls 37900->37901 37902 7ff81f45207a DeleteObject 37901->37902 37902->37878 37904 7ff81f451e45 37903->37904 37909 7ff81f453990 37904->37909 37906 7ff81f451e8c 37920 7ff81f453c50 37906->37920 37908 7ff81f451eab 37908->37882 37910 7ff81f4539d0 GetDC SelectObject GetTextMetricsW GetTextFaceW 37909->37910 37912 7ff81f453a2c 37910->37912 37925 7ff81f453e40 37912->37925 37914 7ff81f453bed GetCharWidthA 37916 7ff81f453bf3 SelectObject ReleaseDC 37914->37916 37915 7ff81f453be5 GetCharWidthW 37915->37916 37919 7ff81f453c2d 37916->37919 37917 7ff81f453b76 37917->37914 37917->37915 37919->37906 37921 7ff81f453de5 37920->37921 37924 7ff81f453c74 37920->37924 37921->37908 37922 7ff81f453c90 DeleteObject 37923 7ff81f453cac DeleteObject 37922->37923 37922->37924 37923->37924 37924->37921 37924->37922 37926 7ff81f453e8a SelectObject GetTextFaceW 37925->37926 37927 7ff81f453ec4 37926->37927 37928 7ff81f453f16 SelectObject 37927->37928 37929 7ff81f453f2d 37928->37929 37930 7ff81f453f51 memset 37929->37930 37931 7ff81f453f9b 37929->37931 37933 7ff81f455080 SelectObject 37930->37933 37931->37917 37934 7ff81f4550fa GetFontData 37933->37934 37935 7ff81f4550f2 37933->37935 37936 7ff81f45540a GetTextCharset 37934->37936 37943 7ff81f455136 37934->37943 37935->37934 37937 7ff81f455449 SelectObject 37936->37937 37940 7ff81f455408 37936->37940 37938 7ff81f455478 37937->37938 37938->37931 37939 7ff81f455173 GetFontData 37939->37943 37940->37937 37941 7ff81f455240 GetFontData 37941->37943 37942 7ff81f4552df GetFontData GetFontData 37942->37943 37943->37937 37943->37939 37943->37940 37943->37941 37943->37942 37944 7ff81f448350 37945 7ff81f448380 37944->37945 37946 7ff81f44851a DefWindowProcW 37945->37946 37947 7ff81f448513 37945->37947 37946->37947 37948 7ff81f451310 37949 7ff81f451330 SendMessageW SendMessageW SendMessageW 37948->37949 37953 7ff81f4513b6 37948->37953 37950 7ff81f4513a9 37949->37950 37950->37953 37951 7ff81f451458 37952 7ff81f45ea7c GetFocus 37954 7ff81f45eaa5 GetForegroundWindow 37952->37954 37956 7ff81f45eab0 IsWindow 37952->37956 37953->37951 37953->37952 37954->37956 37957 7ff81f45ee4f SetWindowLongPtrW 37956->37957 37958 7ff81f45eaff 37956->37958 37959 7ff81f45ee8c SetParent 37957->37959 37960 7ff81f45ee77 SetWindowLongPtrW 37957->37960 37958->37957 37961 7ff81f45ef7c 37959->37961 37962 7ff81f45eea2 SendMessageW SendMessageW 37959->37962 37960->37959 37963 7ff81f45ef8f SendMessageW 37961->37963 37964 7ff81f45f001 37961->37964 37962->37961 37965 7ff81f45eee0 GetDesktopWindow 37962->37965 37963->37964 37968 7ff81f45efa9 SendMessageW 37963->37968 37966 7ff81f45f03a 37964->37966 37967 7ff81f45f017 SetWindowPos 37964->37967 37965->37961 37969 7ff81f45eeef SetWindowLongPtrW 37965->37969 37992 7ff81f45f330 37966->37992 37967->37966 37973 7ff81f45efdf 37968->37973 37971 7ff81f45ef68 SetMenu DestroyWindow 37969->37971 37980 7ff81f45ef09 37969->37980 37971->37961 37972 7ff81f45f044 37974 7ff81f45f06e 37972->37974 37975 7ff81f45f059 SendMessageW 37972->37975 37997 7ff81f4cfe20 GetModuleHandleW RegisterClassW RegisterClassW 37973->37997 37977 7ff81f45f07b SendMessageW 37974->37977 37978 7ff81f45f091 37974->37978 37975->37974 37977->37978 37981 7ff81f45f09d SendMessageW 37978->37981 37982 7ff81f45f109 37978->37982 37979 7ff81f45efe7 SendMessageW 37979->37964 37980->37971 37986 7ff81f45ef3f SetParent 37980->37986 37983 7ff81f45f0bd 37981->37983 37984 7ff81f45f115 SetMenu 37982->37984 37990 7ff81f45f12d 37982->37990 37987 7ff81f45cf40 ShowWindow 37983->37987 37984->37990 37985 7ff81f45f182 SetActiveWindow 37989 7ff81f45f1de 37985->37989 37986->37980 37987->37982 37990->37985 37991 7ff81f45f330 ShowWindow 37990->37991 37991->37990 37993 7ff81f45f347 37992->37993 37996 7ff81f45f355 37992->37996 37993->37972 37994 7ff81f45f384 ShowWindow 37995 7ff81f45f395 37994->37995 37995->37972 37996->37994 37996->37995 37997->37979 37998 7ff6c647cc3c 38019 7ff6c647ce0c 37998->38019 38001 7ff6c647cd88 38170 7ff6c647d12c 7 API calls 2 library calls 38001->38170 38002 7ff6c647cc58 __scrt_acquire_startup_lock 38004 7ff6c647cd92 38002->38004 38010 7ff6c647cc76 __scrt_release_startup_lock 38002->38010 38171 7ff6c647d12c 7 API calls 2 library calls 38004->38171 38006 7ff6c647cc9b 38007 7ff6c647cd9d _CallSETranslator 38008 7ff6c647cd21 38025 7ff6c647d274 38008->38025 38010->38006 38010->38008 38167 7ff6c6489b2c 45 API calls 38010->38167 38011 7ff6c647cd26 38028 7ff6c6471000 38011->38028 38017 7ff6c647cd49 38017->38007 38169 7ff6c647cf90 7 API calls 38017->38169 38018 7ff6c647cd60 38018->38006 38020 7ff6c647ce14 38019->38020 38021 7ff6c647ce20 __scrt_dllmain_crt_thread_attach 38020->38021 38022 7ff6c647cc50 38021->38022 38023 7ff6c647ce2d 38021->38023 38022->38001 38022->38002 38023->38022 38172 7ff6c647d888 7 API calls 2 library calls 38023->38172 38173 7ff6c649a4d0 38025->38173 38029 7ff6c6471009 38028->38029 38175 7ff6c6485484 38029->38175 38031 7ff6c64737fb 38182 7ff6c64736b0 38031->38182 38038 7ff6c647383c 38281 7ff6c6471c80 38038->38281 38039 7ff6c647391b 38286 7ff6c64745c0 38039->38286 38043 7ff6c647385b 38254 7ff6c6478830 38043->38254 38044 7ff6c647396a 38309 7ff6c6472710 54 API calls _log10_special 38044->38309 38048 7ff6c647388e 38055 7ff6c64738bb __std_exception_copy 38048->38055 38285 7ff6c64789a0 40 API calls __std_exception_copy 38048->38285 38049 7ff6c647395d 38050 7ff6c6473984 38049->38050 38051 7ff6c6473962 38049->38051 38054 7ff6c6471c80 49 API calls 38050->38054 38305 7ff6c648004c 38051->38305 38056 7ff6c64739a3 38054->38056 38057 7ff6c6478830 14 API calls 38055->38057 38065 7ff6c64738de __std_exception_copy 38055->38065 38060 7ff6c6471950 115 API calls 38056->38060 38057->38065 38059 7ff6c6473a0b 38312 7ff6c64789a0 40 API calls __std_exception_copy 38059->38312 38062 7ff6c64739ce 38060->38062 38062->38043 38064 7ff6c64739de 38062->38064 38063 7ff6c6473a17 38313 7ff6c64789a0 40 API calls __std_exception_copy 38063->38313 38310 7ff6c6472710 54 API calls _log10_special 38064->38310 38070 7ff6c647390e __std_exception_copy 38065->38070 38311 7ff6c6478940 40 API calls __std_exception_copy 38065->38311 38068 7ff6c6473a23 38314 7ff6c64789a0 40 API calls __std_exception_copy 38068->38314 38071 7ff6c6478830 14 API calls 38070->38071 38072 7ff6c6473a3b 38071->38072 38073 7ff6c6473b2f 38072->38073 38074 7ff6c6473a60 __std_exception_copy 38072->38074 38316 7ff6c6472710 54 API calls _log10_special 38073->38316 38084 7ff6c6473aab 38074->38084 38315 7ff6c6478940 40 API calls __std_exception_copy 38074->38315 38077 7ff6c6478830 14 API calls 38078 7ff6c6473bf4 __std_exception_copy 38077->38078 38079 7ff6c6473c46 38078->38079 38080 7ff6c6473d41 38078->38080 38081 7ff6c6473cd4 38079->38081 38082 7ff6c6473c50 38079->38082 38330 7ff6c64744e0 49 API calls 38080->38330 38086 7ff6c6478830 14 API calls 38081->38086 38317 7ff6c64790e0 59 API calls _log10_special 38082->38317 38084->38077 38089 7ff6c6473ce0 38086->38089 38087 7ff6c6473d4f 38090 7ff6c6473d65 38087->38090 38091 7ff6c6473d71 38087->38091 38088 7ff6c6473c55 38092 7ff6c6473cb3 38088->38092 38093 7ff6c6473c61 38088->38093 38089->38093 38097 7ff6c6473ced 38089->38097 38331 7ff6c6474630 38090->38331 38095 7ff6c6471c80 49 API calls 38091->38095 38328 7ff6c6478660 86 API calls 2 library calls 38092->38328 38318 7ff6c6472710 54 API calls _log10_special 38093->38318 38108 7ff6c6473d2b __std_exception_copy 38095->38108 38101 7ff6c6471c80 49 API calls 38097->38101 38098 7ff6c6473dc4 38267 7ff6c6479390 38098->38267 38099 7ff6c6473cbb 38103 7ff6c6473cc8 38099->38103 38104 7ff6c6473cbf 38099->38104 38105 7ff6c6473d0b 38101->38105 38103->38108 38104->38093 38105->38108 38109 7ff6c6473d12 38105->38109 38106 7ff6c6473da7 SetDllDirectoryW LoadLibraryExW 38106->38098 38107 7ff6c6473dd7 SetDllDirectoryW 38113 7ff6c6473e0a 38107->38113 38114 7ff6c6473e5a 38107->38114 38108->38098 38108->38106 38329 7ff6c6472710 54 API calls _log10_special 38109->38329 38112 7ff6c6473808 __std_exception_copy 38319 7ff6c647c550 38112->38319 38116 7ff6c6478830 14 API calls 38113->38116 38115 7ff6c6474008 38114->38115 38117 7ff6c6473f1b 38114->38117 38118 7ff6c6474035 38115->38118 38119 7ff6c6474012 PostMessageW GetMessageW 38115->38119 38122 7ff6c6473e16 __std_exception_copy 38116->38122 38342 7ff6c64733c0 121 API calls 2 library calls 38117->38342 38272 7ff6c6473360 38118->38272 38119->38118 38121 7ff6c6473f23 38121->38112 38123 7ff6c6473f2b 38121->38123 38125 7ff6c6473ef2 38122->38125 38129 7ff6c6473e4e 38122->38129 38343 7ff6c64790c0 LocalFree 38123->38343 38341 7ff6c6478940 40 API calls __std_exception_copy 38125->38341 38129->38114 38334 7ff6c6476dc0 54 API calls memcpy_s 38129->38334 38132 7ff6c647404f 38345 7ff6c6476fc0 FreeLibrary 38132->38345 38137 7ff6c647405b 38141 7ff6c6473e6c 38335 7ff6c6477340 117 API calls 2 library calls 38141->38335 38145 7ff6c6473e81 38147 7ff6c6473ea2 38145->38147 38158 7ff6c6473e85 38145->38158 38336 7ff6c6476e00 120 API calls _log10_special 38145->38336 38147->38158 38337 7ff6c64771b0 125 API calls 38147->38337 38152 7ff6c6473ee0 38340 7ff6c6476fc0 FreeLibrary 38152->38340 38153 7ff6c6473eb7 38153->38158 38338 7ff6c64774f0 55 API calls 38153->38338 38158->38114 38339 7ff6c6472a50 54 API calls _log10_special 38158->38339 38167->38008 38168 7ff6c647d2b8 GetModuleHandleW 38168->38017 38169->38018 38170->38004 38171->38007 38172->38022 38174 7ff6c647d28b GetStartupInfoW 38173->38174 38174->38011 38176 7ff6c648f480 38175->38176 38178 7ff6c648f526 38176->38178 38179 7ff6c648f4d3 38176->38179 38347 7ff6c648f358 71 API calls _fread_nolock 38178->38347 38346 7ff6c648a814 37 API calls 2 library calls 38179->38346 38181 7ff6c648f4fc 38181->38031 38348 7ff6c647c850 38182->38348 38185 7ff6c64736eb GetLastError 38355 7ff6c6472c50 51 API calls _log10_special 38185->38355 38186 7ff6c6473710 38350 7ff6c6479280 FindFirstFileExW 38186->38350 38190 7ff6c6473706 38194 7ff6c647c550 _log10_special 8 API calls 38190->38194 38191 7ff6c647377d 38358 7ff6c6479440 WideCharToMultiByte WideCharToMultiByte __std_exception_copy 38191->38358 38192 7ff6c6473723 38356 7ff6c6479300 CreateFileW GetFinalPathNameByHandleW CloseHandle 38192->38356 38197 7ff6c64737b5 38194->38197 38196 7ff6c6473730 38199 7ff6c647374c __vcrt_FlsAlloc 38196->38199 38200 7ff6c6473734 38196->38200 38197->38112 38204 7ff6c6471950 38197->38204 38198 7ff6c647378b 38198->38190 38359 7ff6c6472810 49 API calls _log10_special 38198->38359 38199->38191 38357 7ff6c6472810 49 API calls _log10_special 38200->38357 38203 7ff6c6473745 38203->38190 38205 7ff6c64745c0 108 API calls 38204->38205 38206 7ff6c6471985 38205->38206 38207 7ff6c6471c43 38206->38207 38209 7ff6c6477f90 83 API calls 38206->38209 38208 7ff6c647c550 _log10_special 8 API calls 38207->38208 38210 7ff6c6471c5e 38208->38210 38211 7ff6c64719cb 38209->38211 38210->38038 38210->38039 38253 7ff6c6471a03 38211->38253 38360 7ff6c64806d4 38211->38360 38213 7ff6c648004c 74 API calls 38213->38207 38214 7ff6c64719e5 38215 7ff6c6471a08 38214->38215 38216 7ff6c64719e9 38214->38216 38364 7ff6c648039c 38215->38364 38367 7ff6c6484f08 11 API calls memcpy_s 38216->38367 38219 7ff6c64719ee 38368 7ff6c6472910 54 API calls _log10_special 38219->38368 38222 7ff6c6471a26 38369 7ff6c6484f08 11 API calls memcpy_s 38222->38369 38223 7ff6c6471a45 38227 7ff6c6471a5c 38223->38227 38228 7ff6c6471a7b 38223->38228 38225 7ff6c6471a2b 38370 7ff6c6472910 54 API calls _log10_special 38225->38370 38371 7ff6c6484f08 11 API calls memcpy_s 38227->38371 38230 7ff6c6471c80 49 API calls 38228->38230 38232 7ff6c6471a92 38230->38232 38231 7ff6c6471a61 38372 7ff6c6472910 54 API calls _log10_special 38231->38372 38234 7ff6c6471c80 49 API calls 38232->38234 38235 7ff6c6471add 38234->38235 38236 7ff6c64806d4 73 API calls 38235->38236 38237 7ff6c6471b01 38236->38237 38238 7ff6c6471b16 38237->38238 38239 7ff6c6471b35 38237->38239 38373 7ff6c6484f08 11 API calls memcpy_s 38238->38373 38240 7ff6c648039c _fread_nolock 53 API calls 38239->38240 38242 7ff6c6471b4a 38240->38242 38245 7ff6c6471b50 38242->38245 38246 7ff6c6471b6f 38242->38246 38243 7ff6c6471b1b 38374 7ff6c6472910 54 API calls _log10_special 38243->38374 38375 7ff6c6484f08 11 API calls memcpy_s 38245->38375 38377 7ff6c6480110 37 API calls 2 library calls 38246->38377 38249 7ff6c6471b55 38376 7ff6c6472910 54 API calls _log10_special 38249->38376 38250 7ff6c6471b89 38250->38253 38378 7ff6c6472710 54 API calls _log10_special 38250->38378 38253->38213 38255 7ff6c647883a 38254->38255 38256 7ff6c6479390 2 API calls 38255->38256 38257 7ff6c6478859 GetEnvironmentVariableW 38256->38257 38258 7ff6c6478876 ExpandEnvironmentStringsW 38257->38258 38259 7ff6c64788c2 38257->38259 38258->38259 38260 7ff6c6478898 38258->38260 38261 7ff6c647c550 _log10_special 8 API calls 38259->38261 38408 7ff6c6479440 WideCharToMultiByte WideCharToMultiByte __std_exception_copy 38260->38408 38263 7ff6c64788d4 38261->38263 38263->38048 38264 7ff6c64788aa 38265 7ff6c647c550 _log10_special 8 API calls 38264->38265 38266 7ff6c64788ba 38265->38266 38266->38048 38268 7ff6c64793b2 MultiByteToWideChar 38267->38268 38270 7ff6c64793d6 38267->38270 38268->38270 38271 7ff6c64793ec __std_exception_copy 38268->38271 38269 7ff6c64793f3 MultiByteToWideChar 38269->38271 38270->38269 38270->38271 38271->38107 38409 7ff6c6476360 38272->38409 38276 7ff6c6473381 38280 7ff6c6473399 38276->38280 38477 7ff6c6476050 38276->38477 38278 7ff6c647338d 38278->38280 38486 7ff6c64761e0 54 API calls 38278->38486 38344 7ff6c6473670 FreeLibrary 38280->38344 38282 7ff6c6471ca5 38281->38282 38625 7ff6c6484984 38282->38625 38285->38055 38287 7ff6c64745cc 38286->38287 38288 7ff6c6479390 2 API calls 38287->38288 38289 7ff6c64745f4 38288->38289 38290 7ff6c6479390 2 API calls 38289->38290 38291 7ff6c6474607 38290->38291 38648 7ff6c6485f94 38291->38648 38294 7ff6c647c550 _log10_special 8 API calls 38295 7ff6c647392b 38294->38295 38295->38044 38296 7ff6c6477f90 38295->38296 38297 7ff6c6477fb4 38296->38297 38298 7ff6c64806d4 73 API calls 38297->38298 38303 7ff6c647808b __std_exception_copy 38297->38303 38299 7ff6c6477fd0 38298->38299 38299->38303 38816 7ff6c64878c8 38299->38816 38301 7ff6c64806d4 73 API calls 38304 7ff6c6477fe5 38301->38304 38302 7ff6c648039c _fread_nolock 53 API calls 38302->38304 38303->38049 38304->38301 38304->38302 38304->38303 38306 7ff6c648007c 38305->38306 38832 7ff6c647fe28 38306->38832 38308 7ff6c6480095 38308->38044 38309->38112 38310->38112 38311->38059 38312->38063 38313->38068 38314->38070 38315->38084 38316->38112 38317->38088 38318->38112 38320 7ff6c647c559 38319->38320 38321 7ff6c6473ca7 38320->38321 38322 7ff6c647c8e0 IsProcessorFeaturePresent 38320->38322 38321->38168 38323 7ff6c647c8f8 38322->38323 38844 7ff6c647cad8 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 38323->38844 38325 7ff6c647c90b 38845 7ff6c647c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 38325->38845 38328->38099 38329->38112 38330->38087 38332 7ff6c6471c80 49 API calls 38331->38332 38333 7ff6c6474660 38332->38333 38333->38108 38334->38141 38335->38145 38336->38147 38337->38153 38338->38158 38339->38152 38340->38114 38341->38114 38342->38121 38344->38132 38345->38137 38346->38181 38347->38181 38349 7ff6c64736bc GetModuleFileNameW 38348->38349 38349->38185 38349->38186 38351 7ff6c64792d2 38350->38351 38352 7ff6c64792bf FindClose 38350->38352 38353 7ff6c647c550 _log10_special 8 API calls 38351->38353 38352->38351 38354 7ff6c647371a 38353->38354 38354->38191 38354->38192 38355->38190 38356->38196 38357->38203 38358->38198 38359->38190 38361 7ff6c6480704 38360->38361 38379 7ff6c6480464 38361->38379 38363 7ff6c648071d 38363->38214 38392 7ff6c64803bc 38364->38392 38367->38219 38368->38253 38369->38225 38370->38253 38371->38231 38372->38253 38373->38243 38374->38253 38375->38249 38376->38253 38377->38250 38378->38253 38380 7ff6c64804ce 38379->38380 38381 7ff6c648048e 38379->38381 38380->38381 38382 7ff6c64804da 38380->38382 38391 7ff6c648a814 37 API calls 2 library calls 38381->38391 38390 7ff6c648546c EnterCriticalSection 38382->38390 38385 7ff6c64804df 38386 7ff6c64805e8 71 API calls 38385->38386 38387 7ff6c64804f1 38386->38387 38388 7ff6c6485478 _fread_nolock LeaveCriticalSection 38387->38388 38389 7ff6c64804b5 38388->38389 38389->38363 38391->38389 38393 7ff6c64803e6 38392->38393 38394 7ff6c6471a20 38392->38394 38393->38394 38395 7ff6c64803f5 memcpy_s 38393->38395 38396 7ff6c6480432 38393->38396 38394->38222 38394->38223 38406 7ff6c6484f08 11 API calls memcpy_s 38395->38406 38405 7ff6c648546c EnterCriticalSection 38396->38405 38398 7ff6c648043a 38400 7ff6c648013c _fread_nolock 51 API calls 38398->38400 38402 7ff6c6480451 38400->38402 38401 7ff6c648040a 38407 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 38401->38407 38404 7ff6c6485478 _fread_nolock LeaveCriticalSection 38402->38404 38404->38394 38406->38401 38407->38394 38408->38264 38410 7ff6c6476375 38409->38410 38411 7ff6c6471c80 49 API calls 38410->38411 38412 7ff6c64763b1 38411->38412 38413 7ff6c64763dd 38412->38413 38414 7ff6c64763ba 38412->38414 38416 7ff6c6474630 49 API calls 38413->38416 38497 7ff6c6472710 54 API calls _log10_special 38414->38497 38417 7ff6c64763f5 38416->38417 38418 7ff6c6476413 38417->38418 38498 7ff6c6472710 54 API calls _log10_special 38417->38498 38487 7ff6c6474560 38418->38487 38420 7ff6c647c550 _log10_special 8 API calls 38423 7ff6c647336e 38420->38423 38423->38280 38440 7ff6c6476500 38423->38440 38424 7ff6c647642b 38426 7ff6c6474630 49 API calls 38424->38426 38425 7ff6c6478e80 3 API calls 38425->38424 38427 7ff6c6476444 38426->38427 38428 7ff6c6476469 38427->38428 38429 7ff6c6476449 38427->38429 38493 7ff6c6478e80 38428->38493 38499 7ff6c6472710 54 API calls _log10_special 38429->38499 38432 7ff6c64763d3 38432->38420 38433 7ff6c6476476 38434 7ff6c6476482 38433->38434 38435 7ff6c64764c1 38433->38435 38437 7ff6c6479390 2 API calls 38434->38437 38501 7ff6c6475830 137 API calls 38435->38501 38438 7ff6c647649a GetLastError 38437->38438 38500 7ff6c6472c50 51 API calls _log10_special 38438->38500 38502 7ff6c6475400 38440->38502 38442 7ff6c6476526 38443 7ff6c647652e 38442->38443 38444 7ff6c647653f 38442->38444 38527 7ff6c6472710 54 API calls _log10_special 38443->38527 38509 7ff6c6474c90 38444->38509 38448 7ff6c647655c 38452 7ff6c647656c 38448->38452 38454 7ff6c647657d 38448->38454 38449 7ff6c647654b 38528 7ff6c6472710 54 API calls _log10_special 38449->38528 38451 7ff6c647653a 38451->38276 38529 7ff6c6472710 54 API calls _log10_special 38452->38529 38455 7ff6c647659c 38454->38455 38456 7ff6c64765ad 38454->38456 38530 7ff6c6472710 54 API calls _log10_special 38455->38530 38458 7ff6c64765bc 38456->38458 38459 7ff6c64765cd 38456->38459 38531 7ff6c6472710 54 API calls _log10_special 38458->38531 38513 7ff6c6474d50 38459->38513 38463 7ff6c64765dc 38532 7ff6c6472710 54 API calls _log10_special 38463->38532 38464 7ff6c64765ed 38466 7ff6c64765fc 38464->38466 38467 7ff6c647660d 38464->38467 38533 7ff6c6472710 54 API calls _log10_special 38466->38533 38469 7ff6c647661f 38467->38469 38471 7ff6c6476630 38467->38471 38534 7ff6c6472710 54 API calls _log10_special 38469->38534 38474 7ff6c647665a 38471->38474 38535 7ff6c64872b0 73 API calls 38471->38535 38473 7ff6c6476648 38536 7ff6c64872b0 73 API calls 38473->38536 38474->38451 38537 7ff6c6472710 54 API calls _log10_special 38474->38537 38478 7ff6c6476070 38477->38478 38478->38478 38479 7ff6c6476099 38478->38479 38484 7ff6c64760b0 __std_exception_copy 38478->38484 38569 7ff6c6472710 54 API calls _log10_special 38479->38569 38481 7ff6c64760a5 38481->38278 38482 7ff6c64761bb 38482->38278 38484->38482 38485 7ff6c6472710 54 API calls 38484->38485 38539 7ff6c6471470 38484->38539 38485->38484 38486->38280 38488 7ff6c647456a 38487->38488 38489 7ff6c6479390 2 API calls 38488->38489 38490 7ff6c647458f 38489->38490 38491 7ff6c647c550 _log10_special 8 API calls 38490->38491 38492 7ff6c64745b7 38491->38492 38492->38424 38492->38425 38494 7ff6c6479390 2 API calls 38493->38494 38495 7ff6c6478e94 LoadLibraryExW 38494->38495 38496 7ff6c6478eb3 __std_exception_copy 38495->38496 38496->38433 38497->38432 38498->38418 38499->38432 38500->38432 38501->38432 38503 7ff6c647542c 38502->38503 38504 7ff6c6475434 38503->38504 38505 7ff6c64755d4 38503->38505 38538 7ff6c6486aa4 48 API calls 38503->38538 38504->38442 38506 7ff6c6475797 __std_exception_copy 38505->38506 38507 7ff6c64747d0 47 API calls 38505->38507 38506->38442 38507->38505 38510 7ff6c6474cc0 38509->38510 38511 7ff6c647c550 _log10_special 8 API calls 38510->38511 38512 7ff6c6474d2a 38511->38512 38512->38448 38512->38449 38514 7ff6c6474d65 38513->38514 38515 7ff6c6471c80 49 API calls 38514->38515 38516 7ff6c6474db1 38515->38516 38517 7ff6c6471c80 49 API calls 38516->38517 38526 7ff6c6474e33 __std_exception_copy 38516->38526 38518 7ff6c6474df0 38517->38518 38521 7ff6c6479390 2 API calls 38518->38521 38518->38526 38519 7ff6c647c550 _log10_special 8 API calls 38520 7ff6c6474e7e 38519->38520 38520->38463 38520->38464 38522 7ff6c6474e06 38521->38522 38523 7ff6c6479390 2 API calls 38522->38523 38524 7ff6c6474e1d 38523->38524 38525 7ff6c6479390 2 API calls 38524->38525 38525->38526 38526->38519 38527->38451 38528->38451 38529->38451 38530->38451 38531->38451 38532->38451 38533->38451 38534->38451 38535->38473 38536->38474 38537->38451 38538->38503 38540 7ff6c64745c0 108 API calls 38539->38540 38541 7ff6c6471493 38540->38541 38542 7ff6c64714bc 38541->38542 38543 7ff6c647149b 38541->38543 38545 7ff6c64806d4 73 API calls 38542->38545 38592 7ff6c6472710 54 API calls _log10_special 38543->38592 38547 7ff6c64714d1 38545->38547 38546 7ff6c64714ab 38546->38484 38548 7ff6c64714f8 38547->38548 38549 7ff6c64714d5 38547->38549 38553 7ff6c6471508 38548->38553 38554 7ff6c6471532 38548->38554 38593 7ff6c6484f08 11 API calls memcpy_s 38549->38593 38551 7ff6c64714da 38594 7ff6c6472910 54 API calls _log10_special 38551->38594 38595 7ff6c6484f08 11 API calls memcpy_s 38553->38595 38555 7ff6c6471538 38554->38555 38564 7ff6c647154b 38554->38564 38570 7ff6c6471210 38555->38570 38557 7ff6c6471510 38596 7ff6c6472910 54 API calls _log10_special 38557->38596 38560 7ff6c648004c 74 API calls 38562 7ff6c64715c4 38560->38562 38561 7ff6c64714f3 __std_exception_copy 38561->38560 38562->38484 38563 7ff6c648039c _fread_nolock 53 API calls 38563->38564 38564->38561 38564->38563 38565 7ff6c64715d6 38564->38565 38597 7ff6c6484f08 11 API calls memcpy_s 38565->38597 38567 7ff6c64715db 38598 7ff6c6472910 54 API calls _log10_special 38567->38598 38569->38481 38571 7ff6c6471268 38570->38571 38572 7ff6c6471297 38571->38572 38573 7ff6c647126f 38571->38573 38576 7ff6c64712d4 38572->38576 38577 7ff6c64712b1 38572->38577 38603 7ff6c6472710 54 API calls _log10_special 38573->38603 38575 7ff6c6471282 38575->38561 38580 7ff6c64712e6 38576->38580 38586 7ff6c6471309 memcpy_s 38576->38586 38604 7ff6c6484f08 11 API calls memcpy_s 38577->38604 38579 7ff6c64712b6 38605 7ff6c6472910 54 API calls _log10_special 38579->38605 38606 7ff6c6484f08 11 API calls memcpy_s 38580->38606 38583 7ff6c64712eb 38607 7ff6c6472910 54 API calls _log10_special 38583->38607 38584 7ff6c648039c _fread_nolock 53 API calls 38584->38586 38586->38584 38587 7ff6c6480110 37 API calls 38586->38587 38588 7ff6c64712cf __std_exception_copy 38586->38588 38591 7ff6c64713cf 38586->38591 38599 7ff6c6480adc 38586->38599 38587->38586 38588->38561 38608 7ff6c6472710 54 API calls _log10_special 38591->38608 38592->38546 38593->38551 38594->38561 38595->38557 38596->38561 38597->38567 38598->38561 38600 7ff6c6480b0c 38599->38600 38609 7ff6c648082c 38600->38609 38602 7ff6c6480b2a 38602->38586 38603->38575 38604->38579 38605->38588 38606->38583 38607->38588 38608->38588 38610 7ff6c648084c 38609->38610 38615 7ff6c6480879 38609->38615 38611 7ff6c6480856 38610->38611 38612 7ff6c6480881 38610->38612 38610->38615 38623 7ff6c648a814 37 API calls 2 library calls 38611->38623 38616 7ff6c648076c 38612->38616 38615->38602 38624 7ff6c648546c EnterCriticalSection 38616->38624 38618 7ff6c6480789 38619 7ff6c64807ac 74 API calls 38618->38619 38620 7ff6c6480792 38619->38620 38621 7ff6c6485478 _fread_nolock LeaveCriticalSection 38620->38621 38622 7ff6c648079d 38621->38622 38622->38615 38623->38615 38628 7ff6c64849de 38625->38628 38626 7ff6c6484a03 38643 7ff6c648a814 37 API calls 2 library calls 38626->38643 38628->38626 38629 7ff6c6484a3f 38628->38629 38644 7ff6c6482c10 49 API calls _invalid_parameter_noinfo 38629->38644 38631 7ff6c6484a2d 38633 7ff6c647c550 _log10_special 8 API calls 38631->38633 38632 7ff6c6484b1c 38647 7ff6c648a948 11 API calls 2 library calls 38632->38647 38635 7ff6c6471cc8 38633->38635 38635->38043 38636 7ff6c6484ad6 38636->38632 38637 7ff6c6484af1 38636->38637 38638 7ff6c6484b40 38636->38638 38641 7ff6c6484ae8 38636->38641 38645 7ff6c648a948 11 API calls 2 library calls 38637->38645 38638->38632 38639 7ff6c6484b4a 38638->38639 38646 7ff6c648a948 11 API calls 2 library calls 38639->38646 38641->38632 38641->38637 38643->38631 38644->38636 38645->38631 38646->38631 38647->38631 38649 7ff6c6485ec8 38648->38649 38650 7ff6c6485eee 38649->38650 38653 7ff6c6485f21 38649->38653 38679 7ff6c6484f08 11 API calls memcpy_s 38650->38679 38652 7ff6c6485ef3 38680 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 38652->38680 38655 7ff6c6485f27 38653->38655 38656 7ff6c6485f34 38653->38656 38681 7ff6c6484f08 11 API calls memcpy_s 38655->38681 38667 7ff6c648ac28 38656->38667 38658 7ff6c6474616 38658->38294 38661 7ff6c6485f48 38682 7ff6c6484f08 11 API calls memcpy_s 38661->38682 38662 7ff6c6485f55 38674 7ff6c648fecc 38662->38674 38665 7ff6c6485f68 38683 7ff6c6485478 LeaveCriticalSection 38665->38683 38684 7ff6c64902d8 EnterCriticalSection 38667->38684 38669 7ff6c648ac3f 38670 7ff6c648ac9c 19 API calls 38669->38670 38671 7ff6c648ac4a 38670->38671 38672 7ff6c6490338 _isindst LeaveCriticalSection 38671->38672 38673 7ff6c6485f3e 38672->38673 38673->38661 38673->38662 38685 7ff6c648fbc8 38674->38685 38677 7ff6c648ff26 38677->38665 38679->38652 38680->38658 38681->38658 38682->38658 38690 7ff6c648fc03 __vcrt_FlsAlloc 38685->38690 38687 7ff6c648fea1 38704 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 38687->38704 38689 7ff6c648fdd3 38689->38677 38697 7ff6c6496d54 38689->38697 38690->38690 38695 7ff6c648fdca 38690->38695 38700 7ff6c6487a3c 51 API calls 3 library calls 38690->38700 38692 7ff6c648fe35 38692->38695 38701 7ff6c6487a3c 51 API calls 3 library calls 38692->38701 38694 7ff6c648fe54 38694->38695 38702 7ff6c6487a3c 51 API calls 3 library calls 38694->38702 38695->38689 38703 7ff6c6484f08 11 API calls memcpy_s 38695->38703 38705 7ff6c6496354 38697->38705 38700->38692 38701->38694 38702->38695 38703->38687 38704->38689 38706 7ff6c6496389 38705->38706 38707 7ff6c649636b 38705->38707 38706->38707 38710 7ff6c64963a5 38706->38710 38759 7ff6c6484f08 11 API calls memcpy_s 38707->38759 38709 7ff6c6496370 38760 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 38709->38760 38716 7ff6c6496964 38710->38716 38714 7ff6c649637c 38714->38677 38762 7ff6c6496698 38716->38762 38719 7ff6c64969f1 38782 7ff6c6488520 38719->38782 38720 7ff6c64969d9 38794 7ff6c6484ee8 11 API calls memcpy_s 38720->38794 38732 7ff6c64963d0 38732->38714 38761 7ff6c64884f8 LeaveCriticalSection 38732->38761 38739 7ff6c64969de 38795 7ff6c6484f08 11 API calls memcpy_s 38739->38795 38759->38709 38760->38714 38763 7ff6c64966c4 38762->38763 38770 7ff6c64966de 38762->38770 38763->38770 38807 7ff6c6484f08 11 API calls memcpy_s 38763->38807 38765 7ff6c64966d3 38808 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 38765->38808 38767 7ff6c64967ad 38780 7ff6c649680a 38767->38780 38813 7ff6c6489b78 37 API calls 2 library calls 38767->38813 38768 7ff6c649675c 38768->38767 38811 7ff6c6484f08 11 API calls memcpy_s 38768->38811 38770->38768 38809 7ff6c6484f08 11 API calls memcpy_s 38770->38809 38772 7ff6c6496806 38775 7ff6c6496888 38772->38775 38772->38780 38774 7ff6c64967a2 38812 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 38774->38812 38814 7ff6c648a900 17 API calls _isindst 38775->38814 38776 7ff6c6496751 38810 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 38776->38810 38780->38719 38780->38720 38815 7ff6c64902d8 EnterCriticalSection 38782->38815 38794->38739 38795->38732 38807->38765 38808->38770 38809->38776 38810->38768 38811->38774 38812->38767 38813->38772 38817 7ff6c64878f8 38816->38817 38820 7ff6c64873d4 38817->38820 38819 7ff6c6487911 38819->38304 38821 7ff6c64873ef 38820->38821 38822 7ff6c648741e 38820->38822 38831 7ff6c648a814 37 API calls 2 library calls 38821->38831 38830 7ff6c648546c EnterCriticalSection 38822->38830 38825 7ff6c6487423 38826 7ff6c6487440 38 API calls 38825->38826 38828 7ff6c648742f 38826->38828 38827 7ff6c648740f 38827->38819 38829 7ff6c6485478 _fread_nolock LeaveCriticalSection 38828->38829 38829->38827 38831->38827 38833 7ff6c647fe43 38832->38833 38834 7ff6c647fe71 38832->38834 38843 7ff6c648a814 37 API calls 2 library calls 38833->38843 38836 7ff6c647fe63 38834->38836 38842 7ff6c648546c EnterCriticalSection 38834->38842 38836->38308 38838 7ff6c647fe88 38839 7ff6c647fea4 72 API calls 38838->38839 38840 7ff6c647fe94 38839->38840 38841 7ff6c6485478 _fread_nolock LeaveCriticalSection 38840->38841 38841->38836 38843->38836 38844->38325 38846 7ff81f3e02d0 38847 7ff81f3e02e1 38846->38847 38850 7ff81f3e0421 38846->38850 38848 7ff81f3e031b EnterCriticalSection 38847->38848 38849 7ff81f3e02ea InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 38847->38849 38851 7ff81f3e0335 QueryPerformanceFrequency 38848->38851 38852 7ff81f3e0414 LeaveCriticalSection 38848->38852 38849->38848 38853 7ff81f3e044b QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection 38850->38853 38854 7ff81f3e048f 38850->38854 38855 7ff81f3e0364 7 API calls 38851->38855 38856 7ff81f3e040a 38851->38856 38852->38850 38853->38854 38858 7ff81f311840 38855->38858 38856->38852 38859 7ff81f31185f 38858->38859 38860 7ff81f31187a LeaveCriticalSection 38859->38860 38863 7ff81f3118a9 38859->38863 38860->38863 38861 7ff81f311924 LeaveCriticalSection 38862 7ff81f311907 38862->38861 38863->38861 38863->38862 38865 7ff81f39ff60 24 API calls 38863->38865 38865->38861 38866 7ff81f4a0104 38867 7ff81f4a010c 38866->38867 38867->38866 38868 7ff81f4a012a 38867->38868 38870 7ff81f4a2040 38867->38870 38871 7ff81f4a20b3 38870->38871 38872 7ff81f4a204e 38870->38872 38871->38867 38873 7ff81f4a2075 printf 38872->38873 38874 7ff81f4a2089 38872->38874 38873->38874 38876 7ff81f4a1ae0 38874->38876 38877 7ff81f4a1b62 38876->38877 38879 7ff81f4a1b01 38876->38879 38877->38871 38878 7ff81f4a1c3c 38878->38877 38882 7ff81f45bca0 38878->38882 38879->38877 38879->38878 38880 7ff81f4a1c15 GetParent SendMessageW 38879->38880 38880->38877 38883 7ff81f45bcbc GetFocus 38882->38883 38888 7ff81f45bcd2 38882->38888 38883->38888 38884 7ff81f45bd4d 38886 7ff81f45bd5f SetFocus 38884->38886 38887 7ff81f45bd69 38884->38887 38885 7ff81f45bd47 SetForegroundWindow 38885->38884 38886->38887 38887->38877 38888->38884 38888->38885 38889 7ff81f45bd01 38888->38889 38889->38877 38890 7ff81f3052a0 38891 7ff81f3a0280 25 API calls 38890->38891 38897 7ff81f3052c0 38891->38897 38892 7ff81f305455 LeaveCriticalSection 38893 7ff81f305467 38892->38893 38913 7ff81f3ad510 38893->38913 38895 7ff81f3a0280 25 API calls 38895->38897 38896 7ff81f305473 38900 7ff81f30551d 38896->38900 38901 7ff81f3055c5 38896->38901 38902 7ff81f3054fb 38896->38902 38897->38892 38897->38895 38898 7ff81f3053c4 memcpy 38897->38898 38899 7ff81f30544d 38897->38899 38897->38901 38898->38897 38899->38892 38903 7ff81f305622 LeaveCriticalSection 38901->38903 38909 7ff81f305600 38901->38909 38902->38900 38929 7ff81f39ff60 24 API calls 38902->38929 38903->38909 38905 7ff81f30569e LeaveCriticalSection 38907 7ff81f3dfa00 38905->38907 38906 7ff81f30560d 38908 7ff81f3056be LeaveCriticalSection 38907->38908 38909->38905 38909->38906 38910 7ff81f305696 38909->38910 38930 7ff81f39ff60 24 API calls 38909->38930 38931 7ff81f39ff60 24 API calls 38910->38931 38919 7ff81f3ad350 38913->38919 38914 7ff81f3ad713 38914->38896 38915 7ff81f3ad6e3 38917 7ff81f3ad700 LeaveCriticalSection 38915->38917 38916 7ff81f3ad6d4 38918 7ff81f311840 26 API calls 38916->38918 38917->38914 38918->38915 38919->38913 38919->38914 38919->38915 38919->38916 38921 7ff81f3ad417 memcpy 38919->38921 38925 7ff81f3ad44b 38919->38925 38932 7ff81f39ff60 24 API calls 38919->38932 38921->38919 38922 7ff81f3ad495 38921->38922 38924 7ff81f3ad4bd LeaveCriticalSection 38922->38924 38923 7ff81f3ad488 LeaveCriticalSection 38923->38922 38924->38896 38925->38923 38926 7ff81f3ad480 38925->38926 38933 7ff81f39ff60 24 API calls 38925->38933 38934 7ff81f39ff60 24 API calls 38926->38934 38929->38900 38930->38910 38931->38905 38932->38919 38933->38926 38934->38923 38935 7ff81f513130 38937 7ff81f51315f 38935->38937 38936 7ff81f5131dd 38937->38936 38940 7ff81f46b040 38937->38940 38939 7ff81f5132b4 38943 7ff81f46b068 38940->38943 38941 7ff81f46b4bf memset 38942 7ff81f46b4e5 38941->38942 38943->38941 38944 7ff81f28e998 38945 7ff81f28e9b4 38944->38945 38947 7ff81f28e9a8 38944->38947 38948 7ff81f28eb70 38945->38948 38953 7ff81f28e320 38948->38953 38951 7ff81f28e320 24 API calls 38952 7ff81f28ebb0 38951->38952 38952->38947 38954 7ff81f28e340 38953->38954 38955 7ff81f28e354 38953->38955 38957 7ff81f28fa60 38954->38957 38955->38951 38955->38952 38960 7ff81f28faa7 38957->38960 38958 7ff81f28faad 38958->38955 38959 7ff81f28fbf1 38961 7ff81f28fbff 38959->38961 38970 7ff81f39ff60 24 API calls 38959->38970 38960->38958 38960->38959 38969 7ff81f39ff60 24 API calls 38960->38969 38964 7ff81f28fc0d 38961->38964 38971 7ff81f39ff60 24 API calls 38961->38971 38966 7ff81f28fc1b 38964->38966 38972 7ff81f39ff60 24 API calls 38964->38972 38966->38958 38973 7ff81f39ff60 24 API calls 38966->38973 38969->38959 38970->38961 38971->38964 38972->38966 38973->38958 38974 7ff81f33d010 38975 7ff81f33d065 38974->38975 38980 7ff81f33d057 38974->38980 38976 7ff81f33d350 38975->38976 38979 7ff81f33d258 38975->38979 38975->38980 38976->38980 38981 7ff81f33d8a0 38976->38981 38979->38980 39006 7ff81f33d710 memcpy 38979->39006 38982 7ff81f33d90b 38981->38982 38999 7ff81f33d915 38981->38999 38983 7ff81f3a0280 25 API calls 38982->38983 38982->38999 38983->38999 38984 7ff81f33dd7e _errno 38985 7ff81f33dd8e 38984->38985 38988 7ff81f3a0280 25 API calls 38985->38988 38995 7ff81f33dd49 38985->38995 38986 7ff81f33dce5 _errno 38987 7ff81f33dcf0 38986->38987 38991 7ff81f3a0280 25 API calls 38987->38991 38987->38995 38990 7ff81f33dd02 38988->38990 38992 7ff81f33ddf7 _errno 38990->38992 38990->38995 38991->38990 38992->38995 38998 7ff81f33de7b 38995->38998 39029 7ff81f39ff60 24 API calls 38995->39029 38996 7ff81f337fe0 38 API calls 38996->38999 38997 7ff81f33e001 39003 7ff81f33dca9 38998->39003 39019 7ff81f29baa0 38998->39019 38999->38984 38999->38985 38999->38986 38999->38987 38999->38995 38999->38996 38999->38997 39005 7ff81f33dc44 38999->39005 39007 7ff81f339ba0 38999->39007 39027 7ff81f33e030 24 API calls 38999->39027 39002 7ff81f33df3a 39002->39003 39030 7ff81f39ff60 24 API calls 39002->39030 39003->38980 39005->39003 39028 7ff81f39ff60 24 API calls 39005->39028 39006->38979 39008 7ff81f339bc8 39007->39008 39009 7ff81f339bf1 39008->39009 39042 7ff81f391990 TlsGetValue 39008->39042 39011 7ff81f339c16 39009->39011 39014 7ff81f339d95 39009->39014 39031 7ff81f339e40 39009->39031 39043 7ff81f2a30e0 41 API calls 39009->39043 39044 7ff81f39ff60 24 API calls 39009->39044 39011->38999 39014->39011 39015 7ff81f339dda 39014->39015 39045 7ff81f39ff60 24 API calls 39014->39045 39015->39011 39046 7ff81f39ff60 24 API calls 39015->39046 39021 7ff81f29babf 39019->39021 39020 7ff81f29bb3a 39020->39002 39021->39020 39049 7ff81f2acfd0 39021->39049 39060 7ff81f2ac8f0 39021->39060 39065 7ff81f2ac8a0 39021->39065 39070 7ff81f473270 39021->39070 39073 7ff81f4b2071 39021->39073 39027->38999 39028->39003 39029->38998 39030->39003 39034 7ff81f339e8f 39031->39034 39032 7ff81f33a429 39048 7ff81f391990 TlsGetValue 39032->39048 39034->39032 39036 7ff81f33a3db memcpy 39034->39036 39037 7ff81f33a475 39034->39037 39035 7ff81f33a45e 39035->39009 39038 7ff81f33a401 39036->39038 39047 7ff81f391990 TlsGetValue 39038->39047 39040 7ff81f33a414 39041 7ff81f339e40 TlsGetValue 39040->39041 39041->39032 39042->39009 39043->39009 39044->39009 39045->39015 39046->39011 39047->39040 39048->39035 39050 7ff81f2acfe6 39049->39050 39051 7ff81f2ad00d 39049->39051 39050->39021 39077 7ff81f349700 39051->39077 39053 7ff81f2ad016 39054 7ff81f2ad0cb 39053->39054 39055 7ff81f3a0280 25 API calls 39053->39055 39054->39021 39056 7ff81f2ad029 39055->39056 39057 7ff81f2ad048 39056->39057 39089 7ff81f37e640 39056->39089 39057->39021 39059 7ff81f2ad144 39059->39021 39061 7ff81f2ac903 39060->39061 39062 7ff81f2ac921 39060->39062 39061->39021 39063 7ff81f2ad695 _errno 39062->39063 39064 7ff81f2ad671 39062->39064 39063->39064 39064->39021 39066 7ff81f2ac8b3 39065->39066 39067 7ff81f2ac8d1 39065->39067 39066->39021 39068 7ff81f2ad695 _errno 39067->39068 39069 7ff81f2ad671 39067->39069 39068->39069 39069->39021 39186 7ff81f4732b0 39070->39186 39072 7ff81f473281 39072->39021 39074 7ff81f4b2081 39073->39074 39075 7ff81f4b20c7 39073->39075 39074->39021 39075->39074 39539 7ff81f4bcde0 39075->39539 39078 7ff81f349710 39077->39078 39079 7ff81f349718 39078->39079 39080 7ff81f3a0280 25 API calls 39078->39080 39079->39053 39081 7ff81f349744 39080->39081 39082 7ff81f349766 39081->39082 39083 7ff81f3497c1 39081->39083 39085 7ff81f3a0280 25 API calls 39082->39085 39084 7ff81f3a0280 25 API calls 39083->39084 39088 7ff81f3497c6 39084->39088 39086 7ff81f34977d 39085->39086 39087 7ff81f3497a0 memcpy 39086->39087 39086->39088 39087->39088 39088->39053 39090 7ff81f37e676 39089->39090 39093 7ff81f37e69f 39089->39093 39091 7ff81f3a0280 25 API calls 39090->39091 39092 7ff81f37e67b 39091->39092 39092->39059 39096 7ff81f37e74e 39093->39096 39101 7ff81f37e709 39093->39101 39114 7ff81f37e80d 39093->39114 39094 7ff81f37ea35 strchr 39094->39114 39095 7ff81f3a0280 25 API calls 39095->39114 39097 7ff81f37e7bc 39096->39097 39098 7ff81f37e785 strchr 39096->39098 39109 7ff81f37e746 39096->39109 39096->39114 39100 7ff81f37e7c8 39097->39100 39108 7ff81f37e7d8 39097->39108 39099 7ff81f37e798 39098->39099 39098->39114 39099->39097 39106 7ff81f37e7a9 strchr 39099->39106 39124 7ff81f37ef70 25 API calls 39100->39124 39102 7ff81f37e72f strchr 39101->39102 39101->39109 39101->39114 39102->39109 39102->39114 39104 7ff81f39ff60 24 API calls 39104->39114 39105 7ff81f37ed6e 39105->39109 39126 7ff81f39ff60 24 API calls 39105->39126 39106->39097 39106->39114 39107 7ff81f37e7fa 39125 7ff81f37ef70 25 API calls 39107->39125 39108->39107 39108->39114 39109->39059 39113 7ff81f391990 TlsGetValue 39113->39114 39114->39094 39114->39095 39114->39104 39114->39105 39114->39109 39114->39113 39115 7ff81f37ede2 39114->39115 39117 7ff81f392320 39114->39117 39115->39059 39116 7ff81f37e640 65 API calls 39115->39116 39118 7ff81f392329 39117->39118 39121 7ff81f3923f2 39117->39121 39119 7ff81f392418 39118->39119 39123 7ff81f3923b4 39118->39123 39127 7ff81f390930 39118->39127 39120 7ff81f3923e0 memmove 39120->39121 39121->39114 39123->39120 39123->39121 39124->39109 39125->39109 39126->39109 39128 7ff81f39095b 39127->39128 39129 7ff81f3909c2 TlsAlloc 39128->39129 39130 7ff81f3909e1 TlsGetValue 39128->39130 39183 7ff81f3909ab 39128->39183 39185 7ff81f390bba 39128->39185 39129->39130 39152 7ff81f390ce0 39129->39152 39138 7ff81f3909f9 GetLastError 39130->39138 39147 7ff81f390a0c 39130->39147 39131 7ff81f390c37 TlsAlloc 39132 7ff81f390c56 TlsGetValue 39131->39132 39131->39152 39139 7ff81f390c6e GetLastError 39132->39139 39148 7ff81f390c81 39132->39148 39133 7ff81f390ec9 TlsAlloc 39134 7ff81f390ee8 TlsGetValue 39133->39134 39133->39152 39140 7ff81f390f00 GetLastError 39134->39140 39149 7ff81f390f13 39134->39149 39142 7ff81f390a07 39138->39142 39138->39152 39143 7ff81f390c7c 39139->39143 39139->39152 39141 7ff81f390f0e 39140->39141 39140->39152 39144 7ff81f39fc10 19 API calls 39141->39144 39146 7ff81f39fc10 19 API calls 39142->39146 39145 7ff81f39fc10 19 API calls 39143->39145 39144->39149 39145->39148 39146->39147 39150 7ff81f390ac9 GetProcessHeap HeapReAlloc 39147->39150 39147->39152 39154 7ff81f390a3e 39147->39154 39148->39152 39153 7ff81f390d31 GetProcessHeap HeapReAlloc 39148->39153 39156 7ff81f390caf 39148->39156 39151 7ff81f390f9a GetProcessHeap HeapReAlloc 39149->39151 39149->39152 39155 7ff81f390f41 39149->39155 39150->39183 39151->39152 39152->39123 39153->39185 39154->39152 39158 7ff81f390a7e memcpy 39154->39158 39154->39183 39155->39152 39159 7ff81f390ff1 memcpy 39155->39159 39156->39152 39157 7ff81f390d88 memcpy 39156->39157 39156->39185 39160 7ff81f390da9 TlsAlloc 39157->39160 39161 7ff81f390dc8 TlsGetValue 39157->39161 39162 7ff81f390abe TlsGetValue 39158->39162 39163 7ff81f390a9f TlsAlloc 39158->39163 39164 7ff81f391012 TlsAlloc 39159->39164 39165 7ff81f391031 TlsGetValue 39159->39165 39160->39152 39160->39161 39169 7ff81f390de0 GetLastError 39161->39169 39170 7ff81f390df3 39161->39170 39171 7ff81f390b20 GetLastError 39162->39171 39172 7ff81f390b33 39162->39172 39163->39152 39163->39162 39164->39152 39164->39165 39173 7ff81f391057 39165->39173 39174 7ff81f391049 GetLastError 39165->39174 39169->39152 39175 7ff81f390dee 39169->39175 39170->39152 39181 7ff81f390e13 GetProcessHeap HeapFree 39170->39181 39170->39185 39171->39152 39176 7ff81f390b2e 39171->39176 39172->39152 39182 7ff81f390b53 GetProcessHeap HeapFree 39172->39182 39172->39183 39177 7ff81f391061 39173->39177 39180 7ff81f39fc10 19 API calls 39173->39180 39174->39152 39174->39173 39178 7ff81f39fc10 19 API calls 39175->39178 39179 7ff81f39fc10 19 API calls 39176->39179 39177->39152 39184 7ff81f391081 GetProcessHeap HeapFree 39177->39184 39178->39170 39179->39172 39180->39177 39181->39185 39182->39183 39183->39131 39183->39132 39183->39152 39183->39185 39184->39152 39185->39133 39185->39134 39185->39152 39187 7ff81f4732dd 39186->39187 39188 7ff81f4732e5 GetSystemMetrics 39187->39188 39189 7ff81f4732f4 39187->39189 39188->39189 39191 7ff81f473316 39189->39191 39192 7ff81f473d00 39189->39192 39191->39072 39194 7ff81f473d58 39192->39194 39193 7ff81f474504 39193->39191 39194->39193 39196 7ff81f474570 39194->39196 39197 7ff81f4745e0 39196->39197 39200 7ff81f474689 39197->39200 39202 7ff81f4711e0 39197->39202 39199 7ff81f474830 39199->39193 39200->39199 39201 7ff81f474984 DeleteObject 39200->39201 39201->39199 39203 7ff81f471236 39202->39203 39206 7ff81f47124a 39203->39206 39211 7ff81f471cb0 39203->39211 39205 7ff81f471445 39210 7ff81f47129a 39205->39210 39216 7ff81f444780 39205->39216 39206->39205 39208 7ff81f4712b2 39206->39208 39206->39210 39209 7ff81f444780 23 API calls 39208->39209 39208->39210 39209->39210 39210->39200 39212 7ff81f471cd7 39211->39212 39213 7ff81f471cfb 39212->39213 39220 7ff81f2960c0 39212->39220 39324 7ff81f2955d2 39212->39324 39213->39206 39217 7ff81f4447c2 39216->39217 39219 7ff81f4448da 39217->39219 39517 7ff81f44f420 39217->39517 39219->39210 39227 7ff81f2960c7 39220->39227 39222 7ff81f2961ff 39223 7ff81f30b9f0 42 API calls 39222->39223 39224 7ff81f296215 39223->39224 39225 7ff81f30b9f0 42 API calls 39224->39225 39226 7ff81f29622b 39225->39226 39228 7ff81f30b9f0 42 API calls 39226->39228 39248 7ff81f297521 39227->39248 39456 7ff81f30b9f0 39227->39456 39229 7ff81f296241 39228->39229 39230 7ff81f30b9f0 42 API calls 39229->39230 39231 7ff81f29625f 39230->39231 39232 7ff81f30b9f0 42 API calls 39231->39232 39233 7ff81f296275 39232->39233 39234 7ff81f30b9f0 42 API calls 39233->39234 39235 7ff81f29628b 39234->39235 39236 7ff81f30b9f0 42 API calls 39235->39236 39237 7ff81f2962a1 39236->39237 39238 7ff81f30b9f0 42 API calls 39237->39238 39239 7ff81f2962b7 39238->39239 39240 7ff81f30b9f0 42 API calls 39239->39240 39241 7ff81f2962cd 39240->39241 39242 7ff81f30b9f0 42 API calls 39241->39242 39243 7ff81f2962e3 39242->39243 39244 7ff81f29634c strstr 39243->39244 39281 7ff81f2965a4 39243->39281 39251 7ff81f296368 39244->39251 39245 7ff81f296656 39249 7ff81f2966fd strstr 39245->39249 39257 7ff81f296804 39245->39257 39246 7ff81f29665e strstr 39247 7ff81f2966c9 39246->39247 39247->39245 39490 7ff81f299050 32 API calls 39247->39490 39248->39213 39255 7ff81f296719 39249->39255 39250 7ff81f2963b6 39253 7ff81f2963e5 strstr 39250->39253 39250->39281 39251->39250 39485 7ff81f299050 32 API calls 39251->39485 39259 7ff81f296401 39253->39259 39256 7ff81f296769 39255->39256 39491 7ff81f299050 32 API calls 39255->39491 39256->39257 39258 7ff81f296798 strstr 39256->39258 39257->39248 39268 7ff81f296913 strstr 39257->39268 39284 7ff81f2969cb 39257->39284 39493 7ff81f299050 32 API calls 39257->39493 39266 7ff81f2967b4 39258->39266 39260 7ff81f29644b 39259->39260 39486 7ff81f299050 32 API calls 39259->39486 39261 7ff81f29647a strstr 39260->39261 39260->39281 39264 7ff81f296496 39261->39264 39267 7ff81f2964e0 39264->39267 39487 7ff81f299050 32 API calls 39264->39487 39266->39257 39492 7ff81f299050 32 API calls 39266->39492 39270 7ff81f296513 strstr 39267->39270 39267->39281 39268->39257 39271 7ff81f29652f 39270->39271 39273 7ff81f296579 39271->39273 39488 7ff81f299050 32 API calls 39271->39488 39274 7ff81f2965ac strstr 39273->39274 39273->39281 39277 7ff81f2965c8 39274->39277 39276 7ff81f296b70 39280 7ff81f3a0280 25 API calls 39276->39280 39277->39281 39489 7ff81f299050 32 API calls 39277->39489 39279 7ff81f296aaf strstr 39279->39284 39282 7ff81f296ba2 39280->39282 39281->39245 39281->39246 39282->39248 39283 7ff81f3a0280 25 API calls 39282->39283 39286 7ff81f296bec 39283->39286 39284->39248 39284->39276 39284->39279 39494 7ff81f299050 32 API calls 39284->39494 39286->39248 39287 7ff81f3a0280 25 API calls 39286->39287 39288 7ff81f296c38 39287->39288 39288->39248 39289 7ff81f3a0280 25 API calls 39288->39289 39290 7ff81f296cdf 39289->39290 39290->39248 39291 7ff81f3a0280 25 API calls 39290->39291 39292 7ff81f296d2a 39291->39292 39292->39248 39293 7ff81f3a0280 25 API calls 39292->39293 39294 7ff81f296d76 39293->39294 39294->39248 39295 7ff81f3a0280 25 API calls 39294->39295 39296 7ff81f296e30 39295->39296 39296->39248 39297 7ff81f3a0280 25 API calls 39296->39297 39298 7ff81f296e7c 39297->39298 39298->39248 39299 7ff81f3a0280 25 API calls 39298->39299 39300 7ff81f296f0b 39299->39300 39300->39248 39301 7ff81f3a0280 25 API calls 39300->39301 39302 7ff81f296f57 39301->39302 39302->39248 39303 7ff81f3a0280 25 API calls 39302->39303 39304 7ff81f296ff0 39303->39304 39304->39248 39305 7ff81f3a0280 25 API calls 39304->39305 39306 7ff81f297038 39305->39306 39306->39248 39307 7ff81f3a0280 25 API calls 39306->39307 39308 7ff81f2970d8 39307->39308 39308->39248 39309 7ff81f3a0280 25 API calls 39308->39309 39310 7ff81f297121 39309->39310 39310->39248 39311 7ff81f297206 39310->39311 39495 7ff81f39ff60 24 API calls 39310->39495 39313 7ff81f3a0280 25 API calls 39311->39313 39314 7ff81f297213 39313->39314 39314->39248 39315 7ff81f3a0280 25 API calls 39314->39315 39316 7ff81f297255 39315->39316 39316->39248 39317 7ff81f3a0280 25 API calls 39316->39317 39318 7ff81f2972a1 39317->39318 39318->39248 39319 7ff81f2974e2 zlibVersion 39318->39319 39320 7ff81f297456 strstr 39318->39320 39319->39248 39321 7ff81f297476 39320->39321 39321->39319 39323 7ff81f2974c3 39321->39323 39496 7ff81f299050 32 API calls 39321->39496 39323->39319 39325 7ff81f29566e 39324->39325 39326 7ff81f3a0280 25 API calls 39325->39326 39362 7ff81f297521 39325->39362 39327 7ff81f2956a3 39326->39327 39328 7ff81f3a0280 25 API calls 39327->39328 39327->39362 39329 7ff81f2958f2 39328->39329 39330 7ff81f3a0280 25 API calls 39329->39330 39329->39362 39331 7ff81f29597c 39330->39331 39332 7ff81f3a0280 25 API calls 39331->39332 39333 7ff81f2959aa 39332->39333 39334 7ff81f3a0280 25 API calls 39333->39334 39333->39362 39335 7ff81f295a1e 39334->39335 39336 7ff81f3a0280 25 API calls 39335->39336 39335->39362 39337 7ff81f295a90 39336->39337 39338 7ff81f3a0280 25 API calls 39337->39338 39337->39362 39339 7ff81f295b0e 39338->39339 39340 7ff81f3a0280 25 API calls 39339->39340 39341 7ff81f295b39 39340->39341 39342 7ff81f295b56 _wgetenv 39341->39342 39341->39362 39343 7ff81f3a0280 25 API calls 39342->39343 39344 7ff81f295d04 GetCurrentThreadId _wgetenv 39343->39344 39345 7ff81f295d6a 39344->39345 39345->39362 39497 7ff81f312f40 39345->39497 39347 7ff81f295f14 39348 7ff81f3a0280 25 API calls 39347->39348 39349 7ff81f295f27 39348->39349 39350 7ff81f295fb5 LeaveCriticalSection 39349->39350 39349->39362 39351 7ff81f3dfe90 39350->39351 39352 7ff81f29608b TlsGetValue 39351->39352 39355 7ff81f2960c7 39352->39355 39353 7ff81f30b9f0 42 API calls 39354 7ff81f2961ff 39353->39354 39356 7ff81f30b9f0 42 API calls 39354->39356 39355->39353 39355->39362 39357 7ff81f296215 39356->39357 39358 7ff81f30b9f0 42 API calls 39357->39358 39359 7ff81f29622b 39358->39359 39360 7ff81f30b9f0 42 API calls 39359->39360 39361 7ff81f296241 39360->39361 39363 7ff81f30b9f0 42 API calls 39361->39363 39362->39213 39364 7ff81f29625f 39363->39364 39365 7ff81f30b9f0 42 API calls 39364->39365 39366 7ff81f296275 39365->39366 39367 7ff81f30b9f0 42 API calls 39366->39367 39368 7ff81f29628b 39367->39368 39369 7ff81f30b9f0 42 API calls 39368->39369 39370 7ff81f2962a1 39369->39370 39371 7ff81f30b9f0 42 API calls 39370->39371 39372 7ff81f2962b7 39371->39372 39373 7ff81f30b9f0 42 API calls 39372->39373 39374 7ff81f2962cd 39373->39374 39375 7ff81f30b9f0 42 API calls 39374->39375 39376 7ff81f2962e3 39375->39376 39377 7ff81f2965a4 39376->39377 39378 7ff81f29634c strstr 39376->39378 39379 7ff81f296656 39377->39379 39380 7ff81f29665e strstr 39377->39380 39384 7ff81f296368 39378->39384 39382 7ff81f2966fd strstr 39379->39382 39406 7ff81f296804 39379->39406 39381 7ff81f2966c9 39380->39381 39381->39379 39510 7ff81f299050 32 API calls 39381->39510 39388 7ff81f296719 39382->39388 39383 7ff81f2963b6 39383->39377 39386 7ff81f2963e5 strstr 39383->39386 39384->39383 39505 7ff81f299050 32 API calls 39384->39505 39391 7ff81f296401 39386->39391 39389 7ff81f296769 39388->39389 39511 7ff81f299050 32 API calls 39388->39511 39390 7ff81f296798 strstr 39389->39390 39389->39406 39398 7ff81f2967b4 39390->39398 39392 7ff81f29644b 39391->39392 39506 7ff81f299050 32 API calls 39391->39506 39392->39377 39393 7ff81f29647a strstr 39392->39393 39396 7ff81f296496 39393->39396 39399 7ff81f2964e0 39396->39399 39507 7ff81f299050 32 API calls 39396->39507 39398->39406 39512 7ff81f299050 32 API calls 39398->39512 39399->39377 39402 7ff81f296513 strstr 39399->39402 39400 7ff81f296913 strstr 39400->39406 39403 7ff81f29652f 39402->39403 39405 7ff81f296579 39403->39405 39508 7ff81f299050 32 API calls 39403->39508 39405->39377 39407 7ff81f2965ac strstr 39405->39407 39406->39362 39406->39400 39416 7ff81f2969cb 39406->39416 39513 7ff81f299050 32 API calls 39406->39513 39409 7ff81f2965c8 39407->39409 39409->39377 39509 7ff81f299050 32 API calls 39409->39509 39410 7ff81f296b70 39413 7ff81f3a0280 25 API calls 39410->39413 39412 7ff81f296aaf strstr 39412->39416 39414 7ff81f296ba2 39413->39414 39414->39362 39415 7ff81f3a0280 25 API calls 39414->39415 39418 7ff81f296bec 39415->39418 39416->39362 39416->39410 39416->39412 39514 7ff81f299050 32 API calls 39416->39514 39418->39362 39419 7ff81f3a0280 25 API calls 39418->39419 39420 7ff81f296c38 39419->39420 39420->39362 39421 7ff81f3a0280 25 API calls 39420->39421 39422 7ff81f296cdf 39421->39422 39422->39362 39423 7ff81f3a0280 25 API calls 39422->39423 39424 7ff81f296d2a 39423->39424 39424->39362 39425 7ff81f3a0280 25 API calls 39424->39425 39426 7ff81f296d76 39425->39426 39426->39362 39427 7ff81f3a0280 25 API calls 39426->39427 39428 7ff81f296e30 39427->39428 39428->39362 39429 7ff81f3a0280 25 API calls 39428->39429 39430 7ff81f296e7c 39429->39430 39430->39362 39431 7ff81f3a0280 25 API calls 39430->39431 39432 7ff81f296f0b 39431->39432 39432->39362 39433 7ff81f3a0280 25 API calls 39432->39433 39434 7ff81f296f57 39433->39434 39434->39362 39435 7ff81f3a0280 25 API calls 39434->39435 39436 7ff81f296ff0 39435->39436 39436->39362 39437 7ff81f3a0280 25 API calls 39436->39437 39438 7ff81f297038 39437->39438 39438->39362 39439 7ff81f3a0280 25 API calls 39438->39439 39440 7ff81f2970d8 39439->39440 39440->39362 39441 7ff81f3a0280 25 API calls 39440->39441 39442 7ff81f297121 39441->39442 39442->39362 39443 7ff81f297206 39442->39443 39515 7ff81f39ff60 24 API calls 39442->39515 39445 7ff81f3a0280 25 API calls 39443->39445 39446 7ff81f297213 39445->39446 39446->39362 39447 7ff81f3a0280 25 API calls 39446->39447 39448 7ff81f297255 39447->39448 39448->39362 39449 7ff81f3a0280 25 API calls 39448->39449 39450 7ff81f2972a1 39449->39450 39450->39362 39451 7ff81f2974e2 zlibVersion 39450->39451 39452 7ff81f297456 strstr 39450->39452 39451->39362 39453 7ff81f297476 39452->39453 39453->39451 39455 7ff81f2974c3 39453->39455 39516 7ff81f299050 32 API calls 39453->39516 39455->39451 39458 7ff81f30ba8f 39456->39458 39457 7ff81f30c11e 39479 7ff81f2a0710 25 API calls 39457->39479 39458->39457 39459 7ff81f3a00b0 TlsGetValue 39458->39459 39460 7ff81f30bb72 memcpy 39458->39460 39463 7ff81f30bac5 39458->39463 39459->39458 39460->39458 39461 7ff81f30bf8b 39462 7ff81f30bfb0 39461->39462 39464 7ff81f39ff60 24 API calls 39461->39464 39465 7ff81f30bfd9 39462->39465 39466 7ff81f39ff60 24 API calls 39462->39466 39463->39457 39463->39461 39467 7ff81f3a0280 25 API calls 39463->39467 39464->39462 39468 7ff81f30c094 39465->39468 39469 7ff81f30c005 TlsAlloc 39465->39469 39470 7ff81f30c024 TlsGetValue 39465->39470 39466->39465 39483 7ff81f30bd37 39467->39483 39468->39222 39469->39457 39469->39470 39472 7ff81f30c04a 39470->39472 39473 7ff81f30c03c GetLastError 39470->39473 39474 7ff81f30c054 39472->39474 39475 7ff81f39fc10 19 API calls 39472->39475 39473->39457 39473->39472 39474->39457 39476 7ff81f30c071 39474->39476 39475->39474 39476->39468 39478 7ff81f30c07a GetProcessHeap HeapFree 39476->39478 39477 7ff81f3a0280 25 API calls 39477->39483 39478->39468 39480 7ff81f30c221 39479->39480 39480->39222 39481 7ff81f30bdb6 memcpy 39481->39483 39482 7ff81f30be14 memcpy 39482->39483 39483->39457 39483->39461 39483->39477 39483->39481 39483->39482 39484 7ff81f298710 34 API calls 39483->39484 39484->39483 39485->39250 39486->39260 39487->39267 39488->39273 39489->39281 39490->39245 39491->39256 39492->39257 39493->39257 39494->39284 39495->39311 39496->39319 39498 7ff81f312f58 39497->39498 39499 7ff81f31307c 39498->39499 39500 7ff81f3a0280 25 API calls 39498->39500 39501 7ff81f312f9e 39500->39501 39502 7ff81f3a0280 25 API calls 39501->39502 39503 7ff81f312fd2 39502->39503 39504 7ff81f31303d LeaveCriticalSection 39503->39504 39504->39347 39505->39383 39506->39392 39507->39399 39508->39405 39509->39377 39510->39379 39511->39389 39512->39406 39513->39406 39514->39416 39515->39443 39516->39451 39533 7ff81f44e980 39517->39533 39519 7ff81f44f461 SetROP2 CreateCompatibleDC 39520 7ff81f44f4ae 39519->39520 39532 7ff81f44f5c4 CreateDIBitmap 39519->39532 39521 7ff81f44f4df CreateBitmap 39520->39521 39522 7ff81f44f4ba CreateBitmap 39520->39522 39523 7ff81f44f5a5 SetTextColor SetBkColor 39521->39523 39522->39523 39524 7ff81f44f68d 8 API calls 39523->39524 39527 7ff81f44f75c ReleaseDC 39524->39527 39528 7ff81f44f76b 39524->39528 39530 7ff81f44f779 39527->39530 39528->39530 39531 7ff81f44f770 DeleteDC 39528->39531 39530->39219 39531->39530 39532->39524 39534 7ff81f44e9aa GetDC 39533->39534 39535 7ff81f44e9e2 39533->39535 39536 7ff81f44e9c0 SelectPalette RealizePalette GetBkMode 39534->39536 39535->39536 39537 7ff81f44ea04 CreateCompatibleDC SelectObject 39535->39537 39536->39519 39537->39536 39540 7ff81f4bce21 CreateRectRgnIndirect 39539->39540 39546 7ff81f4bf910 39540->39546 39543 7ff81f4bcec3 39544 7ff81f4bcf4c DeleteObject 39543->39544 39545 7ff81f4bcf52 39543->39545 39544->39545 39545->39074 39548 7ff81f4bf951 39546->39548 39547 7ff81f4bf99d strncmp 39547->39548 39548->39547 39549 7ff81f4bf9da strncmp 39548->39549 39551 7ff81f4bfa44 39548->39551 39553 7ff81f4bfa1b 39548->39553 39549->39548 39551->39543 39552 7ff81f4bff1a 39552->39551 39562 7ff81f4ba940 memset 39552->39562 39553->39551 39555 7ff81f4c0a90 39553->39555 39559 7ff81f4c0ad7 39555->39559 39556 7ff81f4c0b2a _strnicmp 39556->39559 39557 7ff81f4c0bbd _strnicmp 39558 7ff81f4c0b82 39557->39558 39558->39557 39560 7ff81f4c0be1 39558->39560 39559->39556 39559->39558 39559->39560 39568 7ff81f4ba7e0 memset 39559->39568 39560->39552 39563 7ff81f4ba9b0 memset 39562->39563 39564 7ff81f4ba98f 39562->39564 39565 7ff81f4ba9fa 39563->39565 39564->39563 39567 7ff81f4baa02 39565->39567 39572 7ff81f4b9b70 39565->39572 39567->39551 39569 7ff81f4ba859 memset 39568->39569 39570 7ff81f4ba838 39568->39570 39571 7ff81f4ba89f 39569->39571 39570->39569 39571->39559 39575 7ff81f4b9bb7 39572->39575 39573 7ff81f4b9c30 _stricmp 39573->39575 39574 7ff81f4b9d0c 39574->39567 39575->39573 39575->39574 39576 7ff81f4a7b7d 39578 7ff81f4a7b90 39576->39578 39577 7ff81f4a7bc7 strncmp 39577->39578 39578->39577 39579 7ff81f4a7c0a strncmp 39578->39579 39580 7ff81f4a7c4c strncmp 39578->39580 39581 7ff81f4a7c8b strncmp 39578->39581 39582 7ff81f4a7cc4 strncmp 39578->39582 39583 7ff81f4a7cfe 39578->39583 39579->39578 39580->39578 39581->39578 39582->39578 39584 7ff81f4dac60 76 API calls 39583->39584 39585 7ff81f4a7dfa 39583->39585 39593 7ff81f4a8014 39583->39593 39584->39585 39586 7ff81f4a7e45 39585->39586 39594 7ff81f4dac60 39585->39594 39588 7ff81f4a7e8a 39586->39588 39589 7ff81f4dac60 76 API calls 39586->39589 39586->39593 39590 7ff81f4dac60 76 API calls 39588->39590 39591 7ff81f4a7ea8 39588->39591 39589->39588 39590->39591 39592 7ff81f4a7fc8 memset 39591->39592 39591->39593 39592->39593 39595 7ff81f4dac99 39594->39595 39596 7ff81f4dacb2 strchr 39595->39596 39601 7ff81f4dbb10 39595->39601 39599 7ff81f4dacd4 39596->39599 39598 7ff81f4dae05 strncpy 39600 7ff81f4dae26 39598->39600 39599->39598 39599->39600 39600->39586 39602 7ff81f4dbb4b 39601->39602 39603 7ff81f4dbb61 39602->39603 39609 7ff81f4dc100 39602->39609 39605 7ff81f4dbb10 73 API calls 39603->39605 39607 7ff81f4dbb8d 39603->39607 39605->39607 39606 7ff81f4dbe43 memcpy 39608 7ff81f4dbe6c 39606->39608 39607->39606 39607->39608 39608->39596 39610 7ff81f4dc12c 39609->39610 39612 7ff81f2960c0 55 API calls 39610->39612 39613 7ff81f2955d2 61 API calls 39610->39613 39611 7ff81f4dc21d 39612->39611 39613->39611 39614 7ff81f465c00 39616 7ff81f465c11 39614->39616 39618 7ff81f465c1b 39614->39618 39615 7ff81f4672f2 39616->39615 39619 7ff81f4672bb 39616->39619 39621 7ff81f46732d DefWindowProcW 39616->39621 39622 7ff81f46736b ImmGetContext 39616->39622 39617 7ff81f465c90 39618->39617 39620 7ff81f465c48 SendMessageW 39618->39620 39619->39615 39619->39621 39620->39617 39621->39615 39622->39621 39623 7ff81f467379 ImmGetCompositionStringW 39622->39623 39624 7ff81f4674ac ImmReleaseContext 39623->39624 39625 7ff81f467397 ImmGetCompositionStringW 39623->39625 39624->39615 39627 7ff81f4673cb 39625->39627 39628 7ff81f467444 GetTickCount 39627->39628 39629 7ff81f46745e 39628->39629 39629->39624 39630 7ff6c6485628 39631 7ff6c6485642 39630->39631 39632 7ff6c648565f 39630->39632 39655 7ff6c6484ee8 11 API calls memcpy_s 39631->39655 39632->39631 39633 7ff6c6485672 CreateFileW 39632->39633 39635 7ff6c64856dc 39633->39635 39636 7ff6c64856a6 39633->39636 39659 7ff6c6485c04 46 API calls 3 library calls 39635->39659 39658 7ff6c648577c 59 API calls 3 library calls 39636->39658 39637 7ff6c6485647 39656 7ff6c6484f08 11 API calls memcpy_s 39637->39656 39641 7ff6c64856b4 39645 7ff6c64856bb CloseHandle 39641->39645 39646 7ff6c64856d1 CloseHandle 39641->39646 39642 7ff6c64856e1 39647 7ff6c64856e5 39642->39647 39648 7ff6c6485710 39642->39648 39643 7ff6c648564f 39657 7ff6c648a8e0 37 API calls _invalid_parameter_noinfo 39643->39657 39650 7ff6c648565a 39645->39650 39646->39650 39660 7ff6c6484e7c 11 API calls 2 library calls 39647->39660 39661 7ff6c64859c4 51 API calls 39648->39661 39652 7ff6c648571d 39662 7ff6c6485b00 21 API calls _fread_nolock 39652->39662 39654 7ff6c64856ef 39654->39650 39655->39637 39656->39643 39657->39650 39658->39641 39659->39642 39660->39654 39661->39652 39662->39654 39663 7ff81f515c03 39665 7ff81f515c13 39663->39665 39664 7ff81f515d80 39665->39664 39669 7ff81f526370 39665->39669 39667 7ff81f515d72 39667->39664 39677 7ff81f456370 39667->39677 39675 7ff81f5263a0 39669->39675 39670 7ff81f526675 GetModuleHandleW 39671 7ff81f526687 LoadIconW LoadIconW LoadCursorW RegisterClassExW 39670->39671 39672 7ff81f52675c CreateWindowExW SetWindowLongPtrW ShowWindow UpdateWindow 39671->39672 39673 7ff81f5267ce 39671->39673 39672->39673 39682 7ff81f517230 39673->39682 39675->39670 39675->39671 39676 7ff81f526822 39676->39667 39678 7ff81f45638f 39677->39678 39679 7ff81f456380 GetModuleHandleW 39677->39679 39687 7ff81f466890 39678->39687 39679->39678 39681 7ff81f456397 39681->39664 39684 7ff81f517254 39682->39684 39683 7ff81f517280 39683->39676 39684->39683 39685 7ff81f517379 CreateBitmap CreatePatternBrush 39684->39685 39686 7ff81f5173c8 39685->39686 39686->39676 39688 7ff81f4668b5 InitCommonControlsEx 39687->39688 39689 7ff81f466999 39687->39689 39690 7ff81f4668ef RegisterClassW 39688->39690 39691 7ff81f4668de 39688->39691 39689->39681 39692 7ff81f46695b GetKeyboardLayout GetLocaleInfoW 39690->39692 39693 7ff81f46694a 39690->39693 39691->39690 39692->39689 39694 7ff81f466980 TranslateCharsetInfo 39692->39694 39693->39692 39694->39689 39695 7ff81f339360 TlsGetValue 39696 7ff81f339383 39695->39696 39697 7ff81f3393ff 39696->39697 39699 7ff81f3397c6 39696->39699 39701 7ff81f391990 TlsGetValue 39696->39701 39700 7ff81f3397e5 memcpy 39699->39700 39700->39697 39701->39696 39702 7ff81f29de0d 39703 7ff81f29de1d 39702->39703 39704 7ff81f29df93 39703->39704 39710 7ff81f29de27 39703->39710 39729 7ff81f29af20 39704->39729 39706 7ff81f29de99 39741 7ff81f2a0870 31 API calls 39706->39741 39708 7ff81f29deda 39712 7ff81f3a0280 25 API calls 39708->39712 39716 7ff81f29deed 39708->39716 39709 7ff81f29dfac 39713 7ff81f29dffb 39709->39713 39714 7ff81f3a0280 25 API calls 39709->39714 39710->39706 39711 7ff81f29de65 39710->39711 39723 7ff81f29e128 39710->39723 39711->39706 39712->39716 39742 7ff81f314820 25 API calls 39713->39742 39714->39713 39717 7ff81f29df79 39716->39717 39718 7ff81f29e203 39719 7ff81f29e23f 39718->39719 39744 7ff81f39ff60 24 API calls 39718->39744 39720 7ff81f29e1e2 39743 7ff81f35e8d0 31 API calls 39720->39743 39723->39718 39723->39720 39725 7ff81f29e28c 39723->39725 39724 7ff81f29e304 39727 7ff81f29e350 39724->39727 39746 7ff81f39ff60 24 API calls 39724->39746 39725->39724 39745 7ff81f39ff60 24 API calls 39725->39745 39730 7ff81f29af37 39729->39730 39731 7ff81f29af46 39730->39731 39733 7ff81f29b07e 39730->39733 39732 7ff81f3a0280 25 API calls 39731->39732 39738 7ff81f29af50 39732->39738 39734 7ff81f3a0280 25 API calls 39733->39734 39735 7ff81f29b0ba 39733->39735 39734->39735 39735->39709 39736 7ff81f29b02d 39736->39709 39737 7ff81f29afe6 39737->39736 39748 7ff81f39ff60 24 API calls 39737->39748 39738->39735 39738->39737 39747 7ff81f39ff60 24 API calls 39738->39747 39741->39708 39742->39717 39743->39718 39744->39719 39745->39724 39746->39727 39747->39737 39748->39736 39749 7ff81f3545e0 39750 7ff81f3545ff 39749->39750 39753 7ff81f35470f 39749->39753 39751 7ff81f354639 memset 39750->39751 39752 7ff81f35471e 39750->39752 39755 7ff81f35464a 39750->39755 39751->39755 39755->39753 39756 7ff81f39ff60 24 API calls 39755->39756 39756->39753 39757 7ff81f28dec0 TlsGetValue 39758 7ff81f28df1a 39757->39758 39759 7ff81f28df45 memset 39758->39759 39760 7ff81f28df88 39758->39760 39761 7ff81f28df64 39758->39761 39759->39761 39761->39760 39763 7ff81f28e080 39761->39763 39764 7ff81f28e17c 39761->39764 39762 7ff81f28e0d0 39765 7ff81f28e246 39762->39765 39766 7ff81f28e10a 39762->39766 39763->39762 39769 7ff81f28e0bb memset 39763->39769 39764->39760 39784 7ff81f39ff60 24 API calls 39764->39784 39779 7ff81f28e390 39765->39779 39767 7ff81f28fa60 24 API calls 39766->39767 39771 7ff81f28e120 39767->39771 39769->39762 39772 7ff81f28fa60 24 API calls 39771->39772 39773 7ff81f28e29d 39771->39773 39778 7ff81f28e143 39772->39778 39774 7ff81f28e2b5 39773->39774 39785 7ff81f39ff60 24 API calls 39773->39785 39774->39760 39786 7ff81f39ff60 24 API calls 39774->39786 39777 7ff81f28e282 memcpy 39777->39773 39778->39773 39778->39777 39780 7ff81f28fa60 24 API calls 39779->39780 39781 7ff81f28e3c7 39780->39781 39782 7ff81f28fa60 24 API calls 39781->39782 39783 7ff81f28e46d 39781->39783 39782->39783 39783->39778 39784->39760 39785->39774 39786->39760 39787 7ff81f465f1f 39790 7ff81f465250 39787->39790 39789 7ff81f465f27 39791 7ff81f46528e 39790->39791 39792 7ff81f46529c GetWindowLongPtrW 39791->39792 39793 7ff81f465297 39791->39793 39794 7ff81f4652b9 IsWindowVisible 39792->39794 39800 7ff81f4653c4 39792->39800 39793->39794 39795 7ff81f4652da GetWindowPlacement 39794->39795 39798 7ff81f4652d6 39794->39798 39795->39798 39796 7ff81f465335 39797 7ff81f465357 GetClientRect MoveWindow 39796->39797 39796->39800 39797->39800 39798->39796 39799 7ff81f45cf40 ShowWindow 39798->39799 39799->39796 39800->39789 39801 7ff81f2d7840 39803 7ff81f2d7868 39801->39803 39804 7ff81f2d7904 39803->39804 39805 7ff81f3542f0 39803->39805 39806 7ff81f35432b 39805->39806 39807 7ff81f354349 39806->39807 39810 7ff81f354365 39806->39810 39811 7ff81f354353 39806->39811 39812 7ff81f3a00b0 39807->39812 39809 7ff81f35437c memcpy 39809->39811 39810->39809 39810->39811 39811->39804 39813 7ff81f3a00d5 TlsGetValue 39812->39813 39815 7ff81f3a0128 39813->39815 39816 7ff81f3cb2b0 GetFileType 39817 7ff81f3cb2e7 GetConsoleMode 39816->39817 39818 7ff81f3cb2d9 39816->39818 39819 7ff81f3cb2f9 39817->39819 39821 7ff81f3cb300 GetCommState 39817->39821 39818->39819 39820 7ff81f3cb2dd GetLastError 39818->39820 39820->39817 39820->39819 39821->39819 39822 7ff81f4dcce0 39823 7ff81f4dce57 39822->39823 39824 7ff81f4dcd02 39822->39824 39824->39823 39825 7ff81f4dd354 MoveWindow 39824->39825 39826 7ff81f514170 7 API calls 39824->39826 39825->39824 39826->39824 39827 7ff81f515f50 GetWindowLongPtrW 39828 7ff81f515fd6 39827->39828 39832 7ff81f515f92 39827->39832 39831 7ff81f516030 GetSysColor 39828->39831 39828->39832 39829 7ff81f51610d DefWindowProcW 39830 7ff81f51612d 39829->39830 39831->39828 39832->39829 39833 7ff6c6472fe0 39834 7ff6c6472ff0 39833->39834 39835 7ff6c647302b 39834->39835 39836 7ff6c6473041 39834->39836 39861 7ff6c6472710 54 API calls _log10_special 39835->39861 39838 7ff6c6473061 39836->39838 39849 7ff6c6473077 __std_exception_copy 39836->39849 39862 7ff6c6472710 54 API calls _log10_special 39838->39862 39840 7ff6c647c550 _log10_special 8 API calls 39842 7ff6c64731fa 39840->39842 39841 7ff6c6473037 __std_exception_copy 39841->39840 39843 7ff6c6471470 116 API calls 39843->39849 39844 7ff6c6473349 39869 7ff6c6472710 54 API calls _log10_special 39844->39869 39845 7ff6c6471c80 49 API calls 39845->39849 39847 7ff6c6473333 39868 7ff6c6472710 54 API calls _log10_special 39847->39868 39849->39841 39849->39843 39849->39844 39849->39845 39849->39847 39850 7ff6c647330d 39849->39850 39852 7ff6c6473207 39849->39852 39867 7ff6c6472710 54 API calls _log10_special 39850->39867 39853 7ff6c6473273 39852->39853 39863 7ff6c648a404 37 API calls 2 library calls 39852->39863 39855 7ff6c6473290 39853->39855 39856 7ff6c647329e 39853->39856 39864 7ff6c648a404 37 API calls 2 library calls 39855->39864 39865 7ff6c6472dd0 37 API calls 39856->39865 39859 7ff6c647329c 39866 7ff6c6472500 54 API calls __std_exception_copy 39859->39866 39861->39841 39862->39841 39863->39853 39864->39859 39865->39859 39866->39841 39867->39841 39868->39841 39869->39841 39870 7ff81f514255 39871 7ff81f514260 39870->39871 39872 7ff81f5142a6 39871->39872 39874 7ff81f514297 39871->39874 39882 7ff81f45cda0 39872->39882 39879 7ff81f4468d0 39874->39879 39880 7ff81f44693b CreateWindowExW SetWindowPos SetWindowLongPtrW 39879->39880 39881 7ff81f44692c GetModuleHandleW 39879->39881 39881->39880 39883 7ff81f45cdbe 39882->39883 39884 7ff81f45cde3 GetModuleHandleW 39883->39884 39885 7ff81f45cdf2 CreateWindowExW SetWindowPos 39883->39885 39884->39885 39886 7ff81f37fcf0 39888 7ff81f37fd17 39886->39888 39889 7ff81f37fd8c 39888->39889 39890 7ff81f37ff00 69 API calls 39888->39890

                                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                                  Function 00007FF81F2960C0 Relevance: 122.0, APIs: 11, Strings: 58, Instructions: 1258stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: TlsGetValue.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0BEF
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: GetProcessHeap.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0C01
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: HeapAlloc.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0C10
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: GetProcessHeap.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0C29
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: HeapAlloc.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0C38
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: TlsSetValue.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0C7F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0CBF
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: GetProcessHeap.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0CEF
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: HeapReAlloc.KERNEL32(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0D00
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0BD0: memset.VCRUNTIME140(?,?,00000000,00007FF81F375CD1,?,?,?,00007FF81F3AD0F5,?,?,00000000,00007FF81F3AD26E), ref: 00007FF81F3A0D27
                                                                                                                                                                                                                                                  • strstr.VCRUNTIME140 ref: 00007FF81F29635D
                                                                                                                                                                                                                                                  • strstr.VCRUNTIME140 ref: 00007FF81F2963F6
                                                                                                                                                                                                                                                  • strstr.VCRUNTIME140 ref: 00007FF81F29648B
                                                                                                                                                                                                                                                  • strstr.VCRUNTIME140 ref: 00007FF81F296524
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$Alloc$Processstrstr$Value$CriticalErrorLastLeaveSectionmemset
                                                                                                                                                                                                                                                  • String ID: 1.1.0$2.0.1$8.6.13$::tcl$::tcl::Bgerror$::tcl::mathfunc$::tcl::mathop$::tcl::prefix$::tcl::unsupported$::tcl::unsupported::assemble$::tcl::unsupported::corotype$::tcl::unsupported::disassemble$::tcl::unsupported::getbytecode$::tcl::unsupported::representation$::tcl::unsupported::timerate$Can't create math function namespace$Tcl$TclOO$array$athop::$binary$binary decode$binary encode$builtin command with NULL object command proc and a NULL compile proc$can't create math operator namespace$cp1252$dian$dict$encoding$engine$failed to create math operator %s$file$form$hLevel$info$iso8859-1$namespace$namespace eval ::tcl::zlib {variable cmdcounter 0}$package ifneeded TclOO 1.1.0 {# Already present, OK?};namespace eval ::oo { variable version 1.1.0 };namespace eval ::oo { variable patchlevel 1.1.0 };$prefix$string$tcl$tcl::tommath$tcl_precision$threaded$unable to alloc %u bytes$wordSize$zlib$zlibVersion$*($E$W$\$e$k$x,$y$+
                                                                                                                                                                                                                                                  • API String ID: 1372414326-727945282
                                                                                                                                                                                                                                                  • Opcode ID: fa44a45e613d5014408f8807fa574751610f79bdb59262150a810efc06c8b638
                                                                                                                                                                                                                                                  • Instruction ID: f54c6050492a1e9bc6acc43fb0eb503d6defdf63a5675dd735be14c1cc4f1f3d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fa44a45e613d5014408f8807fa574751610f79bdb59262150a810efc06c8b638
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2D2BEB6A09F9285EB24DF21E8502A977A4FF847E4F444236DA4D0BB96EF3CE154C740
                                                                                                                                                                                                                                                  Function 00007FF6C6471000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 678 7ff6c6471000-7ff6c6473806 call 7ff6c647fe18 call 7ff6c647fe20 call 7ff6c647c850 call 7ff6c64853f0 call 7ff6c6485484 call 7ff6c64736b0 692 7ff6c6473808-7ff6c647380f 678->692 693 7ff6c6473814-7ff6c6473836 call 7ff6c6471950 678->693 694 7ff6c6473c97-7ff6c6473cb2 call 7ff6c647c550 692->694 699 7ff6c647383c-7ff6c6473856 call 7ff6c6471c80 693->699 700 7ff6c647391b-7ff6c6473931 call 7ff6c64745c0 693->700 704 7ff6c647385b-7ff6c647389b call 7ff6c6478830 699->704 705 7ff6c647396a-7ff6c647397f call 7ff6c6472710 700->705 706 7ff6c6473933-7ff6c6473960 call 7ff6c6477f90 700->706 713 7ff6c647389d-7ff6c64738a3 704->713 714 7ff6c64738c1-7ff6c64738cc call 7ff6c6484f30 704->714 718 7ff6c6473c8f 705->718 716 7ff6c6473984-7ff6c64739a6 call 7ff6c6471c80 706->716 717 7ff6c6473962-7ff6c6473965 call 7ff6c648004c 706->717 719 7ff6c64738a5-7ff6c64738ad 713->719 720 7ff6c64738af-7ff6c64738bd call 7ff6c64789a0 713->720 726 7ff6c64739fc-7ff6c6473a2a call 7ff6c6478940 call 7ff6c64789a0 * 3 714->726 727 7ff6c64738d2-7ff6c64738e1 call 7ff6c6478830 714->727 731 7ff6c64739b0-7ff6c64739b9 716->731 717->705 718->694 719->720 720->714 754 7ff6c6473a2f-7ff6c6473a3e call 7ff6c6478830 726->754 736 7ff6c64738e7-7ff6c64738ed 727->736 737 7ff6c64739f4-7ff6c64739f7 call 7ff6c6484f30 727->737 731->731 734 7ff6c64739bb-7ff6c64739d8 call 7ff6c6471950 731->734 734->704 743 7ff6c64739de-7ff6c64739ef call 7ff6c6472710 734->743 741 7ff6c64738f0-7ff6c64738fc 736->741 737->726 744 7ff6c6473905-7ff6c6473908 741->744 745 7ff6c64738fe-7ff6c6473903 741->745 743->718 744->737 748 7ff6c647390e-7ff6c6473916 call 7ff6c6484f30 744->748 745->741 745->744 748->754 757 7ff6c6473a44-7ff6c6473a47 754->757 758 7ff6c6473b45-7ff6c6473b53 754->758 757->758 759 7ff6c6473a4d-7ff6c6473a50 757->759 760 7ff6c6473b59-7ff6c6473b5d 758->760 761 7ff6c6473a67 758->761 762 7ff6c6473a56-7ff6c6473a5a 759->762 763 7ff6c6473b14-7ff6c6473b17 759->763 764 7ff6c6473a6b-7ff6c6473a90 call 7ff6c6484f30 760->764 761->764 762->763 765 7ff6c6473a60 762->765 766 7ff6c6473b19-7ff6c6473b1d 763->766 767 7ff6c6473b2f-7ff6c6473b40 call 7ff6c6472710 763->767 773 7ff6c6473aab-7ff6c6473ac0 764->773 774 7ff6c6473a92-7ff6c6473aa6 call 7ff6c6478940 764->774 765->761 766->767 769 7ff6c6473b1f-7ff6c6473b2a 766->769 775 7ff6c6473c7f-7ff6c6473c87 767->775 769->764 777 7ff6c6473be8-7ff6c6473bfa call 7ff6c6478830 773->777 778 7ff6c6473ac6-7ff6c6473aca 773->778 774->773 775->718 787 7ff6c6473bfc-7ff6c6473c02 777->787 788 7ff6c6473c2e 777->788 780 7ff6c6473bcd-7ff6c6473be2 call 7ff6c6471940 778->780 781 7ff6c6473ad0-7ff6c6473ae8 call 7ff6c6485250 778->781 780->777 780->778 791 7ff6c6473aea-7ff6c6473b02 call 7ff6c6485250 781->791 792 7ff6c6473b62-7ff6c6473b7a call 7ff6c6485250 781->792 789 7ff6c6473c04-7ff6c6473c1c 787->789 790 7ff6c6473c1e-7ff6c6473c2c 787->790 793 7ff6c6473c31-7ff6c6473c40 call 7ff6c6484f30 788->793 789->793 790->793 791->780 802 7ff6c6473b08-7ff6c6473b0f 791->802 800 7ff6c6473b7c-7ff6c6473b80 792->800 801 7ff6c6473b87-7ff6c6473b9f call 7ff6c6485250 792->801 803 7ff6c6473c46-7ff6c6473c4a 793->803 804 7ff6c6473d41-7ff6c6473d63 call 7ff6c64744e0 793->804 800->801 813 7ff6c6473bac-7ff6c6473bc4 call 7ff6c6485250 801->813 814 7ff6c6473ba1-7ff6c6473ba5 801->814 802->780 806 7ff6c6473cd4-7ff6c6473ce6 call 7ff6c6478830 803->806 807 7ff6c6473c50-7ff6c6473c5f call 7ff6c64790e0 803->807 817 7ff6c6473d65-7ff6c6473d6f call 7ff6c6474630 804->817 818 7ff6c6473d71-7ff6c6473d82 call 7ff6c6471c80 804->818 822 7ff6c6473ce8-7ff6c6473ceb 806->822 823 7ff6c6473d35-7ff6c6473d3c 806->823 820 7ff6c6473cb3-7ff6c6473cbd call 7ff6c6478660 807->820 821 7ff6c6473c61 807->821 813->780 835 7ff6c6473bc6 813->835 814->813 826 7ff6c6473d87-7ff6c6473d96 817->826 818->826 840 7ff6c6473cc8-7ff6c6473ccf 820->840 841 7ff6c6473cbf-7ff6c6473cc6 820->841 829 7ff6c6473c68 call 7ff6c6472710 821->829 822->823 830 7ff6c6473ced-7ff6c6473d10 call 7ff6c6471c80 822->830 823->829 832 7ff6c6473d98-7ff6c6473d9f 826->832 833 7ff6c6473dc4-7ff6c6473dda call 7ff6c6479390 826->833 842 7ff6c6473c6d-7ff6c6473c77 829->842 846 7ff6c6473d2b-7ff6c6473d33 call 7ff6c6484f30 830->846 847 7ff6c6473d12-7ff6c6473d26 call 7ff6c6472710 call 7ff6c6484f30 830->847 832->833 838 7ff6c6473da1-7ff6c6473da5 832->838 850 7ff6c6473ddc 833->850 851 7ff6c6473de8-7ff6c6473e04 SetDllDirectoryW 833->851 835->780 838->833 844 7ff6c6473da7-7ff6c6473dbe SetDllDirectoryW LoadLibraryExW 838->844 840->826 841->829 842->775 844->833 846->826 847->842 850->851 854 7ff6c6473e0a-7ff6c6473e19 call 7ff6c6478830 851->854 855 7ff6c6473f01-7ff6c6473f08 851->855 867 7ff6c6473e1b-7ff6c6473e21 854->867 868 7ff6c6473e32-7ff6c6473e3c call 7ff6c6484f30 854->868 857 7ff6c6474008-7ff6c6474010 855->857 858 7ff6c6473f0e-7ff6c6473f15 855->858 862 7ff6c6474035-7ff6c6474040 call 7ff6c64736a0 call 7ff6c6473360 857->862 863 7ff6c6474012-7ff6c647402f PostMessageW GetMessageW 857->863 858->857 861 7ff6c6473f1b-7ff6c6473f25 call 7ff6c64733c0 858->861 861->842 875 7ff6c6473f2b-7ff6c6473f3f call 7ff6c64790c0 861->875 880 7ff6c6474045-7ff6c6474067 call 7ff6c6473670 call 7ff6c6476fc0 call 7ff6c6476d70 862->880 863->862 872 7ff6c6473e2d-7ff6c6473e2f 867->872 873 7ff6c6473e23-7ff6c6473e2b 867->873 877 7ff6c6473ef2-7ff6c6473efc call 7ff6c6478940 868->877 878 7ff6c6473e42-7ff6c6473e48 868->878 872->868 873->872 888 7ff6c6473f64-7ff6c6473fa7 call 7ff6c6478940 call 7ff6c64789e0 call 7ff6c6476fc0 call 7ff6c6476d70 call 7ff6c64788e0 875->888 889 7ff6c6473f41-7ff6c6473f5e PostMessageW GetMessageW 875->889 877->855 878->877 882 7ff6c6473e4e-7ff6c6473e54 878->882 886 7ff6c6473e56-7ff6c6473e58 882->886 887 7ff6c6473e5f-7ff6c6473e61 882->887 891 7ff6c6473e5a 886->891 892 7ff6c6473e67-7ff6c6473e83 call 7ff6c6476dc0 call 7ff6c6477340 886->892 887->855 887->892 926 7ff6c6473fa9-7ff6c6473fbf call 7ff6c6478ed0 call 7ff6c64788e0 888->926 927 7ff6c6473ff5-7ff6c6474003 call 7ff6c6471900 888->927 889->888 891->855 906 7ff6c6473e85-7ff6c6473e8c 892->906 907 7ff6c6473e8e-7ff6c6473e95 892->907 909 7ff6c6473edb-7ff6c6473ef0 call 7ff6c6472a50 call 7ff6c6476fc0 call 7ff6c6476d70 906->909 910 7ff6c6473e97-7ff6c6473ea4 call 7ff6c6476e00 907->910 911 7ff6c6473eaf-7ff6c6473eb9 call 7ff6c64771b0 907->911 909->855 910->911 920 7ff6c6473ea6-7ff6c6473ead 910->920 921 7ff6c6473ebb-7ff6c6473ec2 911->921 922 7ff6c6473ec4-7ff6c6473ed2 call 7ff6c64774f0 911->922 920->909 921->909 922->855 935 7ff6c6473ed4 922->935 926->927 939 7ff6c6473fc1-7ff6c6473fd6 926->939 927->842 935->909 940 7ff6c6473fd8-7ff6c6473feb call 7ff6c6472710 call 7ff6c6471900 939->940 941 7ff6c6473ff0 call 7ff6c6472a50 939->941 940->842 941->927
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                                  • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                                  • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                                  • Opcode ID: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
                                                                                                                                                                                                                                                  • Instruction ID: f0e89fd1bd5235cce201497c603e408134e91843401e6c2fff6d6cecd8d40d4b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F832AF21A0C68295FB27DF2095553B93792AF55786F84C032DADDC32D6EF2EE598C308
                                                                                                                                                                                                                                                  Function 00007FF81F2955D2 Relevance: 60.3, APIs: 6, Strings: 28, Instructions: 757COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: ::tcl$::tcl::mathfunc$::tcl::mathop$::tcl::prefix$::tcl::unsupported$::tcl::unsupported::inject$Can't create math function namespace$INNER$TCL_INTERP_DEBUG_FRAME$TCL_PKG_PREFER_LATEST$Tcl_CreateInterp: can't create global namespace$Trying to push call frame for dead namespace$array$athop::$binary$binary decode$binary encode$builtin command with NULL object command proc and a NULL compile proc$can't create math operator namespace$dict$encoding$failed to create math operator %s$file$info$namespace$prefix$string$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 0-3815954594
                                                                                                                                                                                                                                                  • Opcode ID: fb1e60743f553a47f9eb614ac4c68e1adeccd405ab65ee2e159499160e152e13
                                                                                                                                                                                                                                                  • Instruction ID: 94d9ea0a88806b63f54e0c0fd8b97b141c249afe439daa7334e0e5b79bc508ff
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fb1e60743f553a47f9eb614ac4c68e1adeccd405ab65ee2e159499160e152e13
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FB927A76A05F8285EB44DF24E8903A933A4FB84BA8F58423ACF4D0B365DF39D559C354
                                                                                                                                                                                                                                                  Function 00007FF81F451310 Relevance: 47.6, APIs: 25, Strings: 2, Instructions: 332windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1653 7ff81f451310-7ff81f45132a 1654 7ff81f4513b6-7ff81f4513be 1653->1654 1655 7ff81f451330-7ff81f4513a7 SendMessageW * 3 1653->1655 1658 7ff81f4513c0-7ff81f4513ce 1654->1658 1659 7ff81f451402-7ff81f451409 1654->1659 1656 7ff81f4513ac-7ff81f4513b1 1655->1656 1657 7ff81f4513a9 1655->1657 1656->1654 1657->1656 1658->1659 1662 7ff81f4513d0-7ff81f4513df 1658->1662 1660 7ff81f451458-7ff81f45145d 1659->1660 1661 7ff81f45140b-7ff81f451419 1659->1661 1661->1660 1663 7ff81f45141b-7ff81f45142a 1661->1663 1664 7ff81f4513eb-7ff81f4513f2 1662->1664 1665 7ff81f4513e1 1662->1665 1666 7ff81f45142c 1663->1666 1667 7ff81f451436-7ff81f45143d 1663->1667 1664->1659 1668 7ff81f4513f4-7ff81f4513f8 1664->1668 1665->1664 1666->1667 1667->1660 1669 7ff81f45143f-7ff81f451449 1667->1669 1668->1659 1670 7ff81f4513fa-7ff81f4513fd call 7ff81f45ea00 1668->1670 1669->1660 1672 7ff81f45144b-7ff81f45ea72 1669->1672 1670->1659 1675 7ff81f45ea7c-7ff81f45eaa3 GetFocus 1672->1675 1676 7ff81f45ea74-7ff81f45ea77 call 7ff81f514230 1672->1676 1678 7ff81f45eaa5-7ff81f45eaae GetForegroundWindow 1675->1678 1679 7ff81f45eab0 1675->1679 1676->1675 1678->1679 1680 7ff81f45eab8-7ff81f45eada 1678->1680 1679->1680 1682 7ff81f45eaed-7ff81f45eaf9 IsWindow 1680->1682 1683 7ff81f45eadc-7ff81f45eae3 1680->1683 1684 7ff81f45ee4f-7ff81f45ee75 SetWindowLongPtrW 1682->1684 1685 7ff81f45eaff-7ff81f45eb10 1682->1685 1683->1682 1686 7ff81f45ee8c-7ff81f45ee9c SetParent 1684->1686 1687 7ff81f45ee77-7ff81f45ee86 SetWindowLongPtrW 1684->1687 1685->1684 1689 7ff81f45ef7c-7ff81f45ef8d 1686->1689 1690 7ff81f45eea2-7ff81f45eeda SendMessageW * 2 1686->1690 1687->1686 1691 7ff81f45ef8f-7ff81f45efa7 SendMessageW 1689->1691 1692 7ff81f45f001-7ff81f45f015 1689->1692 1690->1689 1693 7ff81f45eee0-7ff81f45eee9 GetDesktopWindow 1690->1693 1691->1692 1696 7ff81f45efa9-7ff81f45effb SendMessageW call 7ff81f4cfe20 SendMessageW 1691->1696 1694 7ff81f45f03a-7ff81f45f057 call 7ff81f45f330 1692->1694 1695 7ff81f45f017-7ff81f45f034 SetWindowPos 1692->1695 1693->1689 1697 7ff81f45eeef-7ff81f45ef07 SetWindowLongPtrW 1693->1697 1704 7ff81f45f06e-7ff81f45f079 1694->1704 1705 7ff81f45f059-7ff81f45f068 SendMessageW 1694->1705 1695->1694 1696->1692 1699 7ff81f45ef09-7ff81f45ef2b 1697->1699 1700 7ff81f45ef68-7ff81f45ef76 SetMenu DestroyWindow 1697->1700 1699->1700 1707 7ff81f45ef2d 1699->1707 1700->1689 1708 7ff81f45f07b-7ff81f45f08b SendMessageW 1704->1708 1709 7ff81f45f091-7ff81f45f09b 1704->1709 1705->1704 1711 7ff81f45ef30-7ff81f45ef34 1707->1711 1708->1709 1712 7ff81f45f09d-7ff81f45f0bb SendMessageW 1709->1712 1713 7ff81f45f109-7ff81f45f113 1709->1713 1714 7ff81f45ef5c-7ff81f45ef66 1711->1714 1715 7ff81f45ef36-7ff81f45ef3d 1711->1715 1716 7ff81f45f0fd-7ff81f45f104 call 7ff81f45cf40 1712->1716 1717 7ff81f45f0bd-7ff81f45f0f6 1712->1717 1718 7ff81f45f12d-7ff81f45f130 1713->1718 1719 7ff81f45f115-7ff81f45f126 SetMenu 1713->1719 1714->1700 1714->1711 1715->1714 1722 7ff81f45ef3f-7ff81f45ef56 SetParent 1715->1722 1716->1713 1717->1716 1720 7ff81f45f18f-7ff81f45f1c6 SetActiveWindow 1718->1720 1721 7ff81f45f132-7ff81f45f138 1718->1721 1719->1718 1729 7ff81f45f1de-7ff81f45f1f7 call 7ff81f53d4a0 1720->1729 1725 7ff81f45f13a-7ff81f45f148 1721->1725 1726 7ff81f45f182-7ff81f45f189 1721->1726 1722->1714 1725->1726 1730 7ff81f45f14a-7ff81f45f14d 1725->1730 1726->1720 1732 7ff81f45f150-7ff81f45f154 1730->1732 1734 7ff81f45f176-7ff81f45f180 1732->1734 1735 7ff81f45f156-7ff81f45f15d 1732->1735 1734->1726 1734->1732 1735->1734 1736 7ff81f45f15f-7ff81f45f172 call 7ff81f45ea00 call 7ff81f45f330 1735->1736 1736->1734
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: MessageSendWindow$FocusForegroundLong
                                                                                                                                                                                                                                                  • String ID: UpdateWrapper: Cannot find container window$UpdateWrapper: Container was destroyed
                                                                                                                                                                                                                                                  • API String ID: 2937761121-1156326135
                                                                                                                                                                                                                                                  • Opcode ID: a8c1eb03003301c414bd30ac302964574706fa2371894889131fb55fb1a90a9d
                                                                                                                                                                                                                                                  • Instruction ID: 25d2eb0478e51453e93f1666561e8040a10771dbf39be95740c9895218225f79
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a8c1eb03003301c414bd30ac302964574706fa2371894889131fb55fb1a90a9d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 12F12F36605E8286EB649F26E9447A973A0FB88BE4F045235CF5E077A4DF3CE4A5C700
                                                                                                                                                                                                                                                  Function 00007FF81F526370 Relevance: 47.5, APIs: 9, Strings: 18, Instructions: 273windowregistryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$Load$Icon$ClassCreateCursorHandleLongModuleRegisterShowUpdate
                                                                                                                                                                                                                                                  • String ID: 8.6$8.6.13$Button.border$P$Ttk$arrow$classic$downarrow$highlight$hsash$image$label$leftarrow$rightarrow$text$ttk::theme::classic$uparrow$vsash
                                                                                                                                                                                                                                                  • API String ID: 3723784198-2498008350
                                                                                                                                                                                                                                                  • Opcode ID: 00be10b94fce0a9a769e8a036279ef385926a26a53ab264b30358030e0d82707
                                                                                                                                                                                                                                                  • Instruction ID: cb1aa288ab5761c6885894e1078ea57745431d9ec211d96de8a68d20a66674d4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 00be10b94fce0a9a769e8a036279ef385926a26a53ab264b30358030e0d82707
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 16E12666A08F8695EB049F25ED502F973A5FB48BE4F804236E94D07B66EF3CE185C740
                                                                                                                                                                                                                                                  Function 00007FF81F30B9F0 Relevance: 39.1, APIs: 8, Strings: 14, Instructions: 554memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1860 7ff81f30b9f0-7ff81f30babd call 7ff81f3abc30 * 3 1867 7ff81f30babf-7ff81f30bac3 1860->1867 1868 7ff81f30bae1-7ff81f30bb0d call 7ff81f3abc30 call 7ff81f3a97c0 1860->1868 1867->1868 1869 7ff81f30bac5-7ff81f30badc call 7ff81f3abc30 1867->1869 1878 7ff81f30c12f-7ff81f30c13e call 7ff81f37a3f0 1868->1878 1879 7ff81f30bb13-7ff81f30bb1b 1868->1879 1875 7ff81f30bc26-7ff81f30bc6b call 7ff81f35b600 1869->1875 1885 7ff81f30c11e-7ff81f30c12e call 7ff81f37a3f0 1875->1885 1886 7ff81f30bc71-7ff81f30bc74 1875->1886 1891 7ff81f30c13f-7ff81f30c14d call 7ff81f37a3f0 1878->1891 1882 7ff81f30bc89-7ff81f30bc93 1879->1882 1883 7ff81f30bb21-7ff81f30bb2e 1879->1883 1882->1875 1887 7ff81f30bb30-7ff81f30bb43 1883->1887 1885->1878 1892 7ff81f30bca4-7ff81f30bcaa 1886->1892 1893 7ff81f30bc76-7ff81f30bc7a 1886->1893 1889 7ff81f30bb49-7ff81f30bb59 1887->1889 1890 7ff81f30bbca 1887->1890 1896 7ff81f30bb88-7ff81f30bb90 1889->1896 1897 7ff81f30bb5b-7ff81f30bb68 call 7ff81f39fe10 1889->1897 1894 7ff81f30bbce-7ff81f30bc0b call 7ff81f3abc30 1890->1894 1913 7ff81f30c14e-7ff81f30c15c call 7ff81f37a3f0 1891->1913 1901 7ff81f30bcac-7ff81f30bcb3 1892->1901 1902 7ff81f30bcb6-7ff81f30bd16 call 7ff81f35b600 call 7ff81f30a630 1892->1902 1899 7ff81f30bc7c-7ff81f30bc87 1893->1899 1900 7ff81f30bc95-7ff81f30bca0 1893->1900 1894->1887 1916 7ff81f30bc11-7ff81f30bc21 1894->1916 1905 7ff81f30bb92-7ff81f30bb9c 1896->1905 1906 7ff81f30bba3-7ff81f30bbb0 call 7ff81f3a00b0 1896->1906 1917 7ff81f30bb6a-7ff81f30bb6c 1897->1917 1918 7ff81f30bb72-7ff81f30bb86 memcpy 1897->1918 1899->1892 1900->1892 1901->1902 1925 7ff81f30bd1c-7ff81f30bd5c call 7ff81f3abc30 call 7ff81f3a0280 1902->1925 1926 7ff81f30bf9e-7ff81f30bfa9 1902->1926 1905->1906 1912 7ff81f30bb9e-7ff81f30bba1 1905->1912 1923 7ff81f30bbba-7ff81f30bbc0 1906->1923 1924 7ff81f30bbb2-7ff81f30bbb4 1906->1924 1912->1906 1927 7ff81f30c15d-7ff81f30c17c call 7ff81f38be00 call 7ff81f375e40 call 7ff81f37a3f0 1913->1927 1916->1875 1917->1891 1917->1918 1918->1894 1923->1894 1928 7ff81f30bbc2-7ff81f30bbc8 1923->1928 1924->1913 1924->1923 1950 7ff81f30bf8b-7ff81f30bf99 call 7ff81f30ac00 1925->1950 1951 7ff81f30bd62-7ff81f30bd6a 1925->1951 1929 7ff81f30bfab call 7ff81f39ff60 1926->1929 1930 7ff81f30bfb0-7ff81f30bfd2 1926->1930 1962 7ff81f30c17d-7ff81f30c18b call 7ff81f37a3f0 1927->1962 1928->1894 1929->1930 1934 7ff81f30bfd9-7ff81f30bff6 1930->1934 1935 7ff81f30bfd4 call 7ff81f39ff60 1930->1935 1940 7ff81f30bffc-7ff81f30c003 1934->1940 1941 7ff81f30c094-7ff81f30c0c0 call 7ff81f3e1240 1934->1941 1935->1934 1945 7ff81f30c005-7ff81f30c01e TlsAlloc 1940->1945 1946 7ff81f30c026 1940->1946 1952 7ff81f30c1bf-7ff81f30c1cb call 7ff81f37a3f0 1945->1952 1953 7ff81f30c024 1945->1953 1954 7ff81f30c02c-7ff81f30c03a TlsGetValue 1946->1954 1950->1926 1956 7ff81f30bd70 1951->1956 1964 7ff81f30c1cc-7ff81f30c1d8 call 7ff81f37a3f0 1952->1964 1953->1954 1957 7ff81f30c04a-7ff81f30c04d 1954->1957 1958 7ff81f30c03c-7ff81f30c044 GetLastError 1954->1958 1963 7ff81f30bd77-7ff81f30bd7e 1956->1963 1965 7ff81f30c04f-7ff81f30c054 call 7ff81f39fc10 1957->1965 1966 7ff81f30c057-7ff81f30c062 1957->1966 1958->1957 1958->1964 1981 7ff81f30c18c-7ff81f30c19a call 7ff81f37a3f0 1962->1981 1963->1963 1971 7ff81f30bd80 call 7ff81f3a0280 1963->1971 1969 7ff81f30c1d9-7ff81f30c225 call 7ff81f37a3f0 call 7ff81f2a0710 1964->1969 1965->1966 1968 7ff81f30c068-7ff81f30c06b 1966->1968 1966->1969 1968->1969 1975 7ff81f30c071-7ff81f30c078 1968->1975 1983 7ff81f30bd85-7ff81f30bd8c 1971->1983 1979 7ff81f30c07a-7ff81f30c08e GetProcessHeap HeapFree 1975->1979 1980 7ff81f30c0c1-7ff81f30c0e1 1975->1980 1979->1941 1986 7ff81f30c0e3 1980->1986 1987 7ff81f30c0e7-7ff81f30c0f8 1980->1987 1997 7ff81f30c19b-7ff81f30c1ae call 7ff81f37a3f0 1981->1997 1988 7ff81f30bd8e-7ff81f30bd9d 1983->1988 1989 7ff81f30bd9f-7ff81f30bdac call 7ff81f39fe10 1983->1989 1986->1987 1987->1941 1993 7ff81f30c0fa-7ff81f30c10a 1987->1993 1994 7ff81f30bdd5-7ff81f30bdec call 7ff81f3a0280 1988->1994 1999 7ff81f30bdae-7ff81f30bdb0 1989->1999 2000 7ff81f30bdb6-7ff81f30bdd1 memcpy 1989->2000 1993->1941 1998 7ff81f30c10c-7ff81f30c119 call 7ff81f3a0720 1993->1998 2004 7ff81f30bdfe-7ff81f30be0a call 7ff81f39fe10 1994->2004 2005 7ff81f30bdee-7ff81f30bdfc 1994->2005 2010 7ff81f30c1af-7ff81f30c1be call 7ff81f37a3f0 1997->2010 1998->1941 1999->1962 1999->2000 2000->1994 2014 7ff81f30be0c-7ff81f30be0e 2004->2014 2015 7ff81f30be14-7ff81f30be37 memcpy 2004->2015 2008 7ff81f30be3a-7ff81f30be76 call 7ff81f391d70 call 7ff81f2fab80 2005->2008 2020 7ff81f30be78-7ff81f30be7c 2008->2020 2021 7ff81f30be82-7ff81f30be8c 2008->2021 2010->1952 2014->1981 2014->2015 2015->2008 2020->2021 2022 7ff81f30bf67 2020->2022 2023 7ff81f30befb-7ff81f30bf02 2021->2023 2024 7ff81f30be8e-7ff81f30be91 2021->2024 2028 7ff81f30bf6c-7ff81f30bf82 2022->2028 2025 7ff81f30bf3d-7ff81f30bf59 call 7ff81f298f80 2023->2025 2026 7ff81f30bf04-7ff81f30bf0f 2023->2026 2024->2023 2027 7ff81f30be93-7ff81f30be9b 2024->2027 2037 7ff81f30bf5d-7ff81f30bf65 2025->2037 2026->2010 2029 7ff81f30bf15-7ff81f30bf21 2026->2029 2027->2023 2030 7ff81f30be9d-7ff81f30bef3 call 7ff81f298f80 call 7ff81f3abfd0 call 7ff81f3abc30 call 7ff81f298710 2027->2030 2028->1950 2032 7ff81f30bf84-7ff81f30bf86 2028->2032 2029->1997 2038 7ff81f30bf27-7ff81f30bf2d 2029->2038 2030->1927 2046 7ff81f30bef9 2030->2046 2032->1956 2037->2028 2038->1997 2040 7ff81f30bf33-7ff81f30bf37 2038->2040 2040->1997 2040->2025 2046->2037
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3ABC30: memcpy.VCRUNTIME140(?,?,?,?,FFFFFFFF,?,?,?,?,?,?,?,?,?,?,00007FF81F3A0608), ref: 00007FF81F3ABCA9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3ABC30: memcpy.VCRUNTIME140(?,?,EF0341C630438948,00007FF81F3A0608), ref: 00007FF81F3ABCF2
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F30BDC6
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F30BE23
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F298F80: strstr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F32F2B7), ref: 00007FF81F298FB3
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32 ref: 00007FF81F30C005
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32 ref: 00007FF81F30C02E
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00007FF81F30C03C
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F30BB7D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32 ref: 00007FF81F30C080
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32 ref: 00007FF81F30C08E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FF60: TlsAlloc.KERNEL32(?,?,?,00007FF81F311924), ref: 00007FF81F39FF7A
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FF60: TlsGetValue.KERNEL32(?,?,?,00007FF81F311924), ref: 00007FF81F39FFA8
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FF60: GetLastError.KERNEL32(?,?,?,00007FF81F311924), ref: 00007FF81F39FFB6
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FF60: GetProcessHeap.KERNEL32(?,?,?,00007FF81F311924), ref: 00007FF81F39FFF9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FF60: HeapFree.KERNEL32(?,?,?,00007FF81F311924), ref: 00007FF81F3A0007
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$memcpy$Alloc$ErrorLastProcessValue$Free$strstr
                                                                                                                                                                                                                                                  • String ID: :$:$::tcl$TlsGetValue failed from TclpGetAllocCache$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$___tmp$alloc: invalid block: %p: %x %x$could not allocate thread local storage$invalid ensemble name '%s'$tcl:$unable to alloc %u bytes$unable to find or create %s namespace!$unable to realloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3932751553-3831441362
                                                                                                                                                                                                                                                  • Opcode ID: a7d6b304087a19753f17b8e95a591a2b0b62322c1b759563c416e6983b48954d
                                                                                                                                                                                                                                                  • Instruction ID: 13626a5ae907217c86c70ccd4147aa69da7c7aec8d0a87acdf3421464b8fe646
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a7d6b304087a19753f17b8e95a591a2b0b62322c1b759563c416e6983b48954d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C6327D72A08F4286EB14DF65E8802A977A4FF44BE8F584236DA4D8B799DF38E445C740
                                                                                                                                                                                                                                                  Function 00007FF81F3E02D0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 122threadsynchronizationCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$Initialize$Create$EnterEventLeavePerformanceQueryThread$CloseCounterFrequencyHandleObjectPrioritySingleWait
                                                                                                                                                                                                                                                  • String ID: gfffffff
                                                                                                                                                                                                                                                  • API String ID: 1584168963-1523873471
                                                                                                                                                                                                                                                  • Opcode ID: 607c9e9097ddf32b083740b29507f9ea837255c11cde33d59462849dd16d69da
                                                                                                                                                                                                                                                  • Instruction ID: cc8ebb15ee5a18fd109c47097f12a84ab830dc4f9cf964bab76164af5abb19ac
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 607c9e9097ddf32b083740b29507f9ea837255c11cde33d59462849dd16d69da
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 81512875E08E4682FB00CB15F850A797760FF887E4F444236E94E8AAA5DF3CE459CB10
                                                                                                                                                                                                                                                  Function 00007FF81F517230 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 157windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Create$BitmapBrushPattern
                                                                                                                                                                                                                                                  • String ID: 8.6$Button.border$Combobox.focus$Scrollbar.trough$Ttk$alt$border$client$field$focus$slider$thumb$ttk::theme::winnative$winnative
                                                                                                                                                                                                                                                  • API String ID: 3280665104-2094136981
                                                                                                                                                                                                                                                  • Opcode ID: 595afdcf97aeff6b3cbdb58ab7e9707d33f80bc2ef0d63c850dc3ab6ed55cbd0
                                                                                                                                                                                                                                                  • Instruction ID: 67de24369da478b899496eb4bebd0b11e4ba2520077848bcf33c4cc475613e36
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 595afdcf97aeff6b3cbdb58ab7e9707d33f80bc2ef0d63c850dc3ab6ed55cbd0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D67108B6A08F8681EB189B65FC001E963A4FB48BE4F844636DE8D47B66DF3CE155C740
                                                                                                                                                                                                                                                  Function 00007FF81F4BF910 Relevance: 24.5, APIs: 2, Strings: 14, Instructions: 506stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 2264 7ff81f4bf910-7ff81f4bf95d 2266 7ff81f4bf963-7ff81f4bf968 2264->2266 2267 7ff81f4bfa1b-7ff81f4bfa2a 2264->2267 2268 7ff81f4bf970-7ff81f4bf990 2266->2268 2269 7ff81f4bfae1 2267->2269 2270 7ff81f4bfa30-7ff81f4bfa37 2267->2270 2277 7ff81f4bf992-7ff81f4bf995 2268->2277 2278 7ff81f4bfa04 2268->2278 2271 7ff81f4bfae3-7ff81f4bfaea 2269->2271 2270->2271 2272 7ff81f4bfa3d-7ff81f4bfa3f 2270->2272 2273 7ff81f4bfaef-7ff81f4bfb4a call 7ff81f514ed0 call 7ff81f4d9210 2271->2273 2274 7ff81f4bfaec 2271->2274 2272->2271 2288 7ff81f4bfb9d-7ff81f4bfba7 2273->2288 2289 7ff81f4bfb4c 2273->2289 2274->2273 2277->2278 2280 7ff81f4bf997-7ff81f4bf99b 2277->2280 2281 7ff81f4bfa09-7ff81f4bfa15 2278->2281 2283 7ff81f4bf9d1-7ff81f4bf9d8 2280->2283 2284 7ff81f4bf99d-7ff81f4bf9b2 strncmp 2280->2284 2281->2267 2281->2268 2283->2278 2287 7ff81f4bf9da-7ff81f4bf9ec strncmp 2283->2287 2284->2283 2286 7ff81f4bf9b4-7ff81f4bf9ba 2284->2286 2290 7ff81f4bf9c0-7ff81f4bf9cf 2286->2290 2291 7ff81f4bfa44-7ff81f4bfa53 2286->2291 2287->2278 2292 7ff81f4bf9ee-7ff81f4bf9f4 2287->2292 2298 7ff81f4bfbc0-7ff81f4bfbc3 2288->2298 2299 7ff81f4bfba9-7ff81f4bfbac 2288->2299 2297 7ff81f4bfb4f-7ff81f4bfb52 2289->2297 2290->2281 2300 7ff81f4bfa5a-7ff81f4bfac1 2291->2300 2293 7ff81f4bfac6-7ff81f4bfadc 2292->2293 2294 7ff81f4bf9fa-7ff81f4bfa00 2292->2294 2293->2300 2294->2278 2301 7ff81f4bfb70-7ff81f4bfb73 2297->2301 2302 7ff81f4bfb54-7ff81f4bfb5e 2297->2302 2305 7ff81f4bfc10-7ff81f4bfc13 2298->2305 2306 7ff81f4bfbc5-7ff81f4bfbdf 2298->2306 2299->2298 2304 7ff81f4bfbae-7ff81f4bfbb8 2299->2304 2315 7ff81f4c0112-7ff81f4c012c 2300->2315 2308 7ff81f4bfb93-7ff81f4bfb98 2301->2308 2309 7ff81f4bfb75-7ff81f4bfb81 2301->2309 2302->2301 2307 7ff81f4bfb60-7ff81f4bfb67 2302->2307 2304->2298 2311 7ff81f4bfc15-7ff81f4bfc2a 2305->2311 2312 7ff81f4bfc5b-7ff81f4bfc6c call 7ff81f4c02b0 2305->2312 2322 7ff81f4bfbe1-7ff81f4bfbe5 2306->2322 2323 7ff81f4bfbe7 2306->2323 2307->2301 2310 7ff81f4c010a 2308->2310 2309->2308 2314 7ff81f4bfb83-7ff81f4bfb8a 2309->2314 2310->2315 2326 7ff81f4bfc32 2311->2326 2327 7ff81f4bfc2c-7ff81f4bfc30 2311->2327 2324 7ff81f4bfcb9-7ff81f4bfcc0 2312->2324 2325 7ff81f4bfc6e-7ff81f4bfcb4 2312->2325 2314->2308 2328 7ff81f4bfbea-7ff81f4bfbf1 2322->2328 2323->2328 2330 7ff81f4bfcc6-7ff81f4bfcc9 2324->2330 2331 7ff81f4bfebe 2324->2331 2325->2297 2329 7ff81f4bfc35-7ff81f4bfc3c 2326->2329 2327->2329 2333 7ff81f4bfbf3-7ff81f4bfbfd 2328->2333 2334 7ff81f4bfc0c 2328->2334 2338 7ff81f4bfc57 2329->2338 2339 7ff81f4bfc3e-7ff81f4bfc48 2329->2339 2340 7ff81f4bfcd5-7ff81f4bfcf1 2330->2340 2341 7ff81f4bfccb-7ff81f4bfccf 2330->2341 2337 7ff81f4bfec1-7ff81f4bfec6 2331->2337 2333->2334 2335 7ff81f4bfbff 2333->2335 2334->2305 2335->2334 2342 7ff81f4bffce-7ff81f4bffd6 2337->2342 2343 7ff81f4bfecc-7ff81f4bfed3 2337->2343 2338->2312 2339->2338 2344 7ff81f4bfc4a 2339->2344 2354 7ff81f4bfcf3-7ff81f4bfd4c 2340->2354 2355 7ff81f4bfd51-7ff81f4bfd6b 2340->2355 2341->2331 2341->2340 2345 7ff81f4bffe6-7ff81f4bffef 2342->2345 2346 7ff81f4bffd8-7ff81f4bffe2 2342->2346 2343->2342 2348 7ff81f4bfed9-7ff81f4bfedc 2343->2348 2344->2338 2350 7ff81f4bfff1 2345->2350 2351 7ff81f4bfffe 2345->2351 2346->2345 2352 7ff81f4bfee8-7ff81f4bff1c call 7ff81f4c0a90 2348->2352 2353 7ff81f4bfede-7ff81f4bfee2 2348->2353 2350->2351 2356 7ff81f4bfff3-7ff81f4bfffc 2350->2356 2357 7ff81f4c0002-7ff81f4c0009 2351->2357 2352->2297 2369 7ff81f4bff22-7ff81f4bff38 call 7ff81f4c02b0 2352->2369 2353->2342 2353->2352 2354->2297 2355->2297 2366 7ff81f4bfd71-7ff81f4bfd95 2355->2366 2356->2351 2356->2357 2361 7ff81f4c0021-7ff81f4c0039 2357->2361 2362 7ff81f4c000b 2357->2362 2367 7ff81f4c0065-7ff81f4c006c 2361->2367 2368 7ff81f4c003b 2361->2368 2365 7ff81f4c0010-7ff81f4c001f call 7ff81f4c2e30 2362->2365 2365->2361 2387 7ff81f4bfea7-7ff81f4bfeb9 2366->2387 2388 7ff81f4bfd9b-7ff81f4bfddb call 7ff81f4c0680 2366->2388 2370 7ff81f4c008a-7ff81f4c008d 2367->2370 2371 7ff81f4c006e-7ff81f4c0078 2367->2371 2374 7ff81f4c0040-7ff81f4c0063 2368->2374 2369->2325 2382 7ff81f4bff3e-7ff81f4bff4a 2369->2382 2378 7ff81f4c008f-7ff81f4c009b 2370->2378 2379 7ff81f4c00ad-7ff81f4c00c6 2370->2379 2371->2370 2377 7ff81f4c007a-7ff81f4c0081 2371->2377 2374->2367 2377->2370 2378->2379 2384 7ff81f4c009d-7ff81f4c00a4 2378->2384 2385 7ff81f4c0108 2379->2385 2386 7ff81f4c00c8-7ff81f4c00e9 2379->2386 2390 7ff81f4bff77-7ff81f4bffaf call 7ff81f4ba940 2382->2390 2391 7ff81f4bff4c-7ff81f4bff4f 2382->2391 2384->2379 2385->2310 2386->2385 2392 7ff81f4c00eb 2386->2392 2387->2297 2388->2387 2400 7ff81f4bfde1-7ff81f4bfdf7 call 7ff81f4c02b0 2388->2400 2401 7ff81f4bffb2-7ff81f4bffb4 2390->2401 2394 7ff81f4bff51-7ff81f4bff61 2391->2394 2395 7ff81f4bff64-7ff81f4bff74 2391->2395 2398 7ff81f4c00f0-7ff81f4c00f7 2392->2398 2394->2395 2395->2390 2402 7ff81f4c0104 2398->2402 2403 7ff81f4c00f9-7ff81f4c0100 2398->2403 2410 7ff81f4bfe10-7ff81f4bfe19 2400->2410 2411 7ff81f4bfdf9-7ff81f4bfe0b 2400->2411 2401->2297 2407 7ff81f4bffba-7ff81f4bffca 2401->2407 2402->2385 2403->2398 2408 7ff81f4c0102 2403->2408 2407->2342 2408->2385 2413 7ff81f4bfe33-7ff81f4bfe8b 2410->2413 2414 7ff81f4bfe1b-7ff81f4bfe1e 2410->2414 2411->2325 2413->2297 2420 7ff81f4bfe91-7ff81f4bfea5 2413->2420 2414->2413 2416 7ff81f4bfe20-7ff81f4bfe30 2414->2416 2416->2413 2420->2337
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF81F4BF9AA
                                                                                                                                                                                                                                                  • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF81F4BF9E4
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: -data$-format$-translation$IMAGE$MALLOC$MISSING_VALUE$PHOTO$PHOTO_FILE$SAFE$binary$can't get image from a file in a safe interpreter$not enough free memory for image buffer$value for "-data" missing$value for "-format" missing
                                                                                                                                                                                                                                                  • API String ID: 1114863663-986971618
                                                                                                                                                                                                                                                  • Opcode ID: 88a4bbb6b428bfc84c012095e311dbac06624f60c1ce6c9db10d234cc608cf04
                                                                                                                                                                                                                                                  • Instruction ID: e4c086a5a771ffc174496b9732bef42ebcb509748b6351194baa25113b24fb9c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 88a4bbb6b428bfc84c012095e311dbac06624f60c1ce6c9db10d234cc608cf04
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5C329076A08F8286EB548F16E4542B977A4FB88BE4F045236CE8E43B65DF3DE465C700
                                                                                                                                                                                                                                                  Function 00007FF81F337FE0 Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 476COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _errnomemchrmemcpy
                                                                                                                                                                                                                                                  • String ID: Reuse of ChannelBuffer! %p$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$bgerror failed to handle background error.$unable to alloc %u bytes$unknown output translation requested
                                                                                                                                                                                                                                                  • API String ID: 3559638299-3146131670
                                                                                                                                                                                                                                                  • Opcode ID: a6762bac8962d40d380d15d151f0c96fb28b00e6a14e0ef90ed0d81e7eef6bb6
                                                                                                                                                                                                                                                  • Instruction ID: 35b55dce897780f3ca0e60caf6d9ea06e2e0994e82fa41d1aa10f343d2d8649e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a6762bac8962d40d380d15d151f0c96fb28b00e6a14e0ef90ed0d81e7eef6bb6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D0127273A08B8186EB64CF25E44076AB7A0FB847A4F154639DB4D8BB95DF3CE495CB00
                                                                                                                                                                                                                                                  Function 00007FF81F455080 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 273COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DataFont$ObjectSelect$CharsetText
                                                                                                                                                                                                                                                  • String ID: cmap$pamc
                                                                                                                                                                                                                                                  • API String ID: 447340330-4234804082
                                                                                                                                                                                                                                                  • Opcode ID: ec84b9646085c3d108542de55fb4130f4f5abe04bf002ab4018fca5ab658880f
                                                                                                                                                                                                                                                  • Instruction ID: ee433f0455de2f629cd44b23e651799ef8e557b7b076436028199fd76c984980
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ec84b9646085c3d108542de55fb4130f4f5abe04bf002ab4018fca5ab658880f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E8B12372618A9187D7588F16E8002BEB7E1FBD4BA5F405131EE8A83BA8DF7CD451CB00
                                                                                                                                                                                                                                                  Function 00007FF81F37E640 Relevance: 14.2, APIs: 4, Strings: 5, Instructions: 650stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • strchr.VCRUNTIME140(?,?,?,?,?,?,?,00000001,00000000,?,00007FF81F380364), ref: 00007FF81F37E737
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A028D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02BB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02C9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A036B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A037E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A038F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$CriticalErrorLastLeaveProcessSectionValuestrchr
                                                                                                                                                                                                                                                  • String ID: %s called with shared object$/$Tcl_AppendLimitedToObj$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s
                                                                                                                                                                                                                                                  • API String ID: 2255269574-1948534721
                                                                                                                                                                                                                                                  • Opcode ID: 9c82fac51aabba08bab64204bc28125ff87d2f26e565e15712c9b67f89a5d202
                                                                                                                                                                                                                                                  • Instruction ID: 5bbc05a61283397719e6bef4fa3b93a6e75c3b5344c9658641fb5b51731a9b42
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9c82fac51aabba08bab64204bc28125ff87d2f26e565e15712c9b67f89a5d202
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DF42CD22A0CE868AFA649F15D55037967A0EF45BE8F084736DA4D8FB95DF3CE4D08720
                                                                                                                                                                                                                                                  Function 00007FF81F466890 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 62registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Info$CharsetClassCommonControlsInitKeyboardLayoutLocaleRegisterTranslate
                                                                                                                                                                                                                                                  • String ID: TkChild$Unable to load common controls?!$Unable to register TkChild class
                                                                                                                                                                                                                                                  • API String ID: 1007792147-1470692908
                                                                                                                                                                                                                                                  • Opcode ID: 43f6bd6d76b842ecf23f4c96e5ad7584174547979411f7008c6d0a0966b5a4a2
                                                                                                                                                                                                                                                  • Instruction ID: a82194d80f100f1fda2d1d5b1f02961851ae028f073afbbbb8ea84bb94998400
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 43f6bd6d76b842ecf23f4c96e5ad7584174547979411f7008c6d0a0966b5a4a2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 203116A0A18E4296FB149B25FC542B637A4BF987A8F404339D88D46260EF7CE599C740
                                                                                                                                                                                                                                                  Function 00007FF6C6496964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1617910340-0
                                                                                                                                                                                                                                                  • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                  • Instruction ID: 86a57796bb01af0ecdafec2a24e11485e4d402d1676db54a3b4697ae2f7fabfa
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 99C1E132B28A4185EB11CF68C5906BD3765FB89B99B01C239DEAE977D4DF3AD011C344
                                                                                                                                                                                                                                                  Function 00007FF6C6479280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2295610775-0
                                                                                                                                                                                                                                                  • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                  • Instruction ID: 5dbef415feb6bf3dbd26ea3c96f3a12c8a44bb255f8345fa9eb159f919e47e23
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 78F0C222A1C74286F7A18F60B4997A67390AB84769F04C736DAED42AD4DF3DD049CB08
                                                                                                                                                                                                                                                  Function 00007FF81F390930 Relevance: 65.3, APIs: 33, Strings: 4, Instructions: 559memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F3909C2
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F3909EB
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F3909F9
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390A91
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390A9F
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390AD2
                                                                                                                                                                                                                                                  • HeapReAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390AE3
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390B12
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390B20
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390B5A
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390B68
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390C37
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390C60
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390C6E
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390D3A
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390D9B
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390DA9
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390DD2
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390DE0
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390E1A
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390E28
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390EC9
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390EF2
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390F00
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390FA5
                                                                                                                                                                                                                                                  • HeapReAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390FB6
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F391004
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F391012
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F39103B
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F391049
                                                                                                                                                                                                                                                  • HeapReAlloc.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F390D4B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F391087
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(?,?,?,?,?,?,00000000,00007FF81F394C6C,?,?,00000000,00000000,?,?,?,00007FF81F391E77), ref: 00007FF81F391095
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$Alloc$ErrorLastProcessValue$Freememcpy
                                                                                                                                                                                                                                                  • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage$unable to realloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2741067554-2645962790
                                                                                                                                                                                                                                                  • Opcode ID: 781d5deceeaa4db5c95c60a20f42eb9cd81c406407324922096248fa011c1e1a
                                                                                                                                                                                                                                                  • Instruction ID: 94caf9464509a7b5d57722749136978f4577666660324afc9df761ff24bc03f3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 781d5deceeaa4db5c95c60a20f42eb9cd81c406407324922096248fa011c1e1a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5342C3B2A08F8296EB549B25E44467CB7A0FF14BE4F444239DA1E4B791DF3DE865CB00
                                                                                                                                                                                                                                                  Function 00007FF81F451ED0 Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 183COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Object$CreateDeleteFontIndirect$InfoParametersSystem$CapsDeviceReleaseStockmemset
                                                                                                                                                                                                                                                  • String ID: TkCaptionFont$TkDefaultFont$TkFixedFont$TkHeadingFont$TkIconFont$TkMenuFont$TkSmallCaptionFont$TkTextFont$TkTooltipFont
                                                                                                                                                                                                                                                  • API String ID: 3615235001-2508811397
                                                                                                                                                                                                                                                  • Opcode ID: 9c687f750b7356c42ba4938a7190df53978121951853168e0c7d8d247ca50426
                                                                                                                                                                                                                                                  • Instruction ID: 6d0c334be5902a19159d1ebf8179eee7fe9f270a56521e4f5a6ebd01ef0cc56c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9c687f750b7356c42ba4938a7190df53978121951853168e0c7d8d247ca50426
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E2812F31A04E4386EB14DB62EC142F963A1FB89BE5F444236D94E57B65DF3CE18AC740
                                                                                                                                                                                                                                                  Function 00007FF81F4B9B70 Relevance: 56.5, APIs: 1, Strings: 31, Instructions: 510COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1513 7ff81f4b9b70-7ff81f4b9bba call 7ff81f4b8680 1516 7ff81f4b9bc0-7ff81f4b9bd8 1513->1516 1517 7ff81f4b9f2d 1513->1517 1519 7ff81f4b9bde-7ff81f4b9bfd 1516->1519 1520 7ff81f4b9d0c-7ff81f4b9d2e call 7ff81f4b8080 1516->1520 1518 7ff81f4b9f32-7ff81f4b9f64 call 7ff81f53d4a0 1517->1518 1519->1517 1527 7ff81f4b9c03-7ff81f4b9c08 1519->1527 1520->1517 1526 7ff81f4b9d34-7ff81f4b9d42 1520->1526 1529 7ff81f4b9ff8-7ff81f4b9ffb 1526->1529 1530 7ff81f4b9d48-7ff81f4b9d53 1526->1530 1527->1520 1528 7ff81f4b9c0e-7ff81f4b9c1d 1527->1528 1531 7ff81f4b9c20-7ff81f4b9c42 _stricmp 1528->1531 1534 7ff81f4ba001-7ff81f4ba034 1529->1534 1535 7ff81f4b9e38-7ff81f4b9e3e 1529->1535 1532 7ff81f4b9fc0-7ff81f4b9ff3 1530->1532 1533 7ff81f4b9d59-7ff81f4b9d60 1530->1533 1549 7ff81f4b9c48-7ff81f4b9c84 1531->1549 1550 7ff81f4b9cec-7ff81f4b9cf1 1531->1550 1560 7ff81f4b9efe-7ff81f4b9f24 1532->1560 1536 7ff81f4b9d66-7ff81f4b9d6c 1533->1536 1537 7ff81f4b9f88-7ff81f4b9fbb 1533->1537 1534->1560 1538 7ff81f4b9e40-7ff81f4b9e58 call 7ff81f4b8ad0 1535->1538 1539 7ff81f4b9e8a-7ff81f4b9e90 1535->1539 1536->1537 1541 7ff81f4b9d72-7ff81f4b9d85 1536->1541 1537->1560 1538->1517 1557 7ff81f4b9e5e-7ff81f4b9e80 call 7ff81f4b8080 1538->1557 1544 7ff81f4b9e96-7ff81f4b9ec9 1539->1544 1545 7ff81f4ba039-7ff81f4ba063 call 7ff81f4c2250 1539->1545 1541->1537 1551 7ff81f4b9d8b-7ff81f4b9dab call 7ff81f4b7b00 1541->1551 1544->1560 1545->1517 1561 7ff81f4ba069-7ff81f4ba082 1545->1561 1549->1517 1569 7ff81f4b9c8a-7ff81f4b9c91 1549->1569 1559 7ff81f4b9cf5-7ff81f4b9d06 1550->1559 1551->1517 1570 7ff81f4b9db1-7ff81f4b9dc4 call 7ff81f4b7ef0 1551->1570 1557->1517 1577 7ff81f4b9e86 1557->1577 1559->1520 1559->1531 1560->1517 1567 7ff81f4ba084-7ff81f4ba0b0 1561->1567 1568 7ff81f4ba0bc-7ff81f4ba0c9 1561->1568 1567->1568 1574 7ff81f4ba0d5-7ff81f4ba0fb 1568->1574 1575 7ff81f4ba0cb-7ff81f4ba0d3 1568->1575 1572 7ff81f4b9c97-7ff81f4b9cb0 1569->1572 1573 7ff81f4b9f65-7ff81f4b9f86 1569->1573 1570->1517 1585 7ff81f4b9dca-7ff81f4b9dcf 1570->1585 1572->1559 1579 7ff81f4b9cb2-7ff81f4b9ccc 1572->1579 1573->1517 1582 7ff81f4ba107-7ff81f4ba14a 1574->1582 1583 7ff81f4ba0fd 1574->1583 1580 7ff81f4ba101 1575->1580 1577->1539 1579->1517 1593 7ff81f4b9cd2-7ff81f4b9cd7 1579->1593 1580->1582 1601 7ff81f4ba19c-7ff81f4ba1a0 1582->1601 1602 7ff81f4ba14c-7ff81f4ba197 1582->1602 1583->1580 1589 7ff81f4b9dd1-7ff81f4b9ddb 1585->1589 1590 7ff81f4b9e08-7ff81f4b9e2e call 7ff81f4b8080 1585->1590 1591 7ff81f4b9de0-7ff81f4b9e06 1589->1591 1590->1517 1598 7ff81f4b9e34 1590->1598 1591->1590 1591->1591 1596 7ff81f4b9ecb-7ff81f4b9ef7 1593->1596 1597 7ff81f4b9cdd-7ff81f4b9ce6 1593->1597 1596->1560 1597->1550 1597->1596 1598->1535 1604 7ff81f4ba1a2-7ff81f4ba1b9 1601->1604 1605 7ff81f4ba1e1-7ff81f4ba1ed 1601->1605 1602->1517 1606 7ff81f4ba1c2-7ff81f4ba1cb 1604->1606 1607 7ff81f4ba1bb-7ff81f4ba1c0 1604->1607 1608 7ff81f4ba1f0-7ff81f4ba200 call 7ff81f4b98e0 1605->1608 1610 7ff81f4ba1ce-7ff81f4ba1dd 1606->1610 1607->1610 1614 7ff81f4ba205-7ff81f4ba208 1608->1614 1612 7ff81f4ba242-7ff81f4ba258 1610->1612 1613 7ff81f4ba1df 1610->1613 1621 7ff81f4ba290-7ff81f4ba296 1612->1621 1622 7ff81f4ba25a-7ff81f4ba284 1612->1622 1613->1608 1614->1517 1616 7ff81f4ba20e-7ff81f4ba230 call 7ff81f4b8080 1614->1616 1616->1517 1625 7ff81f4ba236-7ff81f4ba240 1616->1625 1623 7ff81f4ba2f0-7ff81f4ba2f5 1621->1623 1624 7ff81f4ba298 1621->1624 1622->1621 1628 7ff81f4ba2f7-7ff81f4ba323 1623->1628 1629 7ff81f4ba32f-7ff81f4ba342 call 7ff81f4b7ef0 1623->1629 1627 7ff81f4ba2a0-7ff81f4ba2b8 call 7ff81f4b7fd0 1624->1627 1625->1608 1625->1612 1627->1517 1637 7ff81f4ba2be-7ff81f4ba2e0 call 7ff81f4b8080 1627->1637 1628->1629 1629->1517 1636 7ff81f4ba348-7ff81f4ba351 1629->1636 1639 7ff81f4ba353 1636->1639 1640 7ff81f4ba359-7ff81f4ba371 1636->1640 1637->1517 1648 7ff81f4ba2e6-7ff81f4ba2ee 1637->1648 1639->1640 1642 7ff81f4ba3e0-7ff81f4ba417 call 7ff81f4c0e40 1639->1642 1640->1642 1643 7ff81f4ba373-7ff81f4ba377 1640->1643 1642->1518 1646 7ff81f4ba3ba-7ff81f4ba3bf 1643->1646 1647 7ff81f4ba379 1643->1647 1649 7ff81f4ba3c0-7ff81f4ba3de 1646->1649 1651 7ff81f4ba380-7ff81f4ba3b6 1647->1651 1648->1623 1648->1627 1649->1642 1649->1649 1651->1651 1652 7ff81f4ba3b8 1651->1652 1652->1642
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcmp$_stricmp
                                                                                                                                                                                                                                                  • String ID: -alpha value must be between 0.0 and 1.0$BAD_ALPHA$BAD_IEND$BAD_PLTE$DNEI$DNEI$ETLP$EXTRA_DATA$IEND chunk contents must be empty$IMAGE$LINE_SIZE$MALLOC$NEED_IDAT$NEED_PLTE$PLTE chunk required for indexed color$PLTE chunk type forbidden for grayscale$PLTE_UNEXPECTED$PNG$SNRt$TADI$TADI$TADI$VUUU$at least one IDAT chunk is required$invalid palette chunk size$line size is out of supported range on this architecture$memory allocation failed$option$png$unfinalized data stream in PNG data$value
                                                                                                                                                                                                                                                  • API String ID: 190063134-2027502129
                                                                                                                                                                                                                                                  • Opcode ID: 52663cf352a29ee30a462647e0a8c9e1154b432b6d36a823b780c763fe36adbb
                                                                                                                                                                                                                                                  • Instruction ID: 7d1c70102d9446b568fe319c3389d48fa8734bf1795f7dbca11f2749d547e333
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 52663cf352a29ee30a462647e0a8c9e1154b432b6d36a823b780c763fe36adbb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C432C076A08E8286EB548F29E8502B977B5FB85BE4F044232DE4E537A6DF3CE455C700
                                                                                                                                                                                                                                                  Function 00007FF81F39FC10 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 184memorythreadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 1808 7ff81f39fc10-7ff81f39fc27 1809 7ff81f39fd49-7ff81f39fd54 call 7ff81f3dfe90 1808->1809 1810 7ff81f39fc2d-7ff81f39fc34 1808->1810 1816 7ff81f39fdd1-7ff81f39fde3 1809->1816 1817 7ff81f39fd56-7ff81f39fd73 GetProcessHeap HeapAlloc 1809->1817 1812 7ff81f39fc36-7ff81f39fc43 InitializeCriticalSection 1810->1812 1813 7ff81f39fc4d-7ff81f39fc61 call 7ff81f3dfa00 1810->1813 1812->1813 1821 7ff81f39fc67-7ff81f39fc78 malloc 1813->1821 1822 7ff81f39fd3c-7ff81f39fd43 LeaveCriticalSection 1813->1822 1819 7ff81f39fd75-7ff81f39fdcf memset call 7ff81f3dfa00 LeaveCriticalSection GetCurrentThreadId TlsSetValue 1817->1819 1820 7ff81f39fde4-7ff81f39fdf0 call 7ff81f37a3f0 1817->1820 1819->1816 1833 7ff81f39fdfe-7ff81f39fe3a call 7ff81f37a3f0 TlsAlloc 1819->1833 1824 7ff81f39fdf1-7ff81f39fdfd call 7ff81f37a3f0 1820->1824 1821->1824 1825 7ff81f39fc7e-7ff81f39fca3 InitializeCriticalSection malloc 1821->1825 1822->1809 1824->1833 1825->1824 1828 7ff81f39fca9-7ff81f39fcc6 InitializeCriticalSection 1825->1828 1831 7ff81f39fcd0-7ff81f39fcfa 1828->1831 1834 7ff81f39fd06-7ff81f39fd1a malloc 1831->1834 1835 7ff81f39fcfc-7ff81f39fd04 1831->1835 1841 7ff81f39fe40-7ff81f39fe5b TlsGetValue 1833->1841 1842 7ff81f39ff44-7ff81f39ff50 call 7ff81f37a3f0 1833->1842 1834->1824 1837 7ff81f39fd20-7ff81f39fd3a InitializeCriticalSection 1834->1837 1835->1834 1837->1822 1837->1831 1846 7ff81f39fe6b-7ff81f39fe73 1841->1846 1847 7ff81f39fe5d-7ff81f39fe65 GetLastError 1841->1847 1848 7ff81f39ff51-7ff81f39ff5f call 7ff81f37a3f0 1842->1848 1849 7ff81f39fe75-7ff81f39fe7a call 7ff81f39fc10 1846->1849 1850 7ff81f39fe7d-7ff81f39feb5 GetProcessHeap HeapAlloc 1846->1850 1847->1846 1847->1848 1849->1850 1855 7ff81f39feb7-7ff81f39ff26 1850->1855 1856 7ff81f39feff-7ff81f39ff01 1850->1856 1859 7ff81f39ff2a-7ff81f39ff43 1855->1859 1856->1859
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$Initialize$malloc$AllocHeapLeaveValue$CurrentErrorLastProcessThreadmemset
                                                                                                                                                                                                                                                  • String ID: TlsGetValue failed from TclpGetAllocCache$TlsSetValue failed from TclpSetAllocCache$alloc: could not allocate new cache$could not allocate lock$could not allocate thread local storage
                                                                                                                                                                                                                                                  • API String ID: 2510295087-2583951768
                                                                                                                                                                                                                                                  • Opcode ID: 5d547626ff2fe665fde4ae7ab395a0c1496ef0a3bc3035a11b27ab6bb9a7575a
                                                                                                                                                                                                                                                  • Instruction ID: 2924596d849bcd6f89c2a9085fae9a77f05d3392a769117a635b64245dc78c96
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5d547626ff2fe665fde4ae7ab395a0c1496ef0a3bc3035a11b27ab6bb9a7575a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E816D25A09F4282FB549B25F8546B837A0FF94BE0F584235DA4E4B7A5EE3CE496C700
                                                                                                                                                                                                                                                  Function 00007FF81F4A7B7D Relevance: 36.3, APIs: 6, Strings: 18, Instructions: 337stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 2047 7ff81f4a7b7d-7ff81f4a7b8b 2048 7ff81f4a7b90-7ff81f4a7bb6 2047->2048 2050 7ff81f4a7cf0-7ff81f4a7cf8 2048->2050 2051 7ff81f4a7bbc-7ff81f4a7bc0 2048->2051 2050->2048 2054 7ff81f4a7cfe-7ff81f4a7d06 2050->2054 2052 7ff81f4a7bc2-7ff81f4a7bc5 2051->2052 2053 7ff81f4a7bff-7ff81f4a7c03 2051->2053 2052->2053 2055 7ff81f4a7bc7-7ff81f4a7bdc strncmp 2052->2055 2058 7ff81f4a7c40-7ff81f4a7c44 2053->2058 2059 7ff81f4a7c05-7ff81f4a7c08 2053->2059 2056 7ff81f4a7d08-7ff81f4a7d16 2054->2056 2057 7ff81f4a7d1a-7ff81f4a7dcf call 7ff81f514ed0 call 7ff81f513870 2054->2057 2062 7ff81f4a7bf8 2055->2062 2063 7ff81f4a7bde-7ff81f4a7bf3 2055->2063 2056->2057 2089 7ff81f4a7dd5-7ff81f4a7de2 2057->2089 2090 7ff81f4a8137 2057->2090 2060 7ff81f4a7c46-7ff81f4a7c4a 2058->2060 2061 7ff81f4a7c7f-7ff81f4a7c83 2058->2061 2059->2058 2065 7ff81f4a7c0a-7ff81f4a7c1f strncmp 2059->2065 2060->2061 2066 7ff81f4a7c4c-7ff81f4a7c61 strncmp 2060->2066 2067 7ff81f4a7c85-7ff81f4a7c89 2061->2067 2068 7ff81f4a7cbe-7ff81f4a7cc2 2061->2068 2062->2053 2063->2050 2070 7ff81f4a7c21-7ff81f4a7c34 2065->2070 2071 7ff81f4a7c39 2065->2071 2072 7ff81f4a7c63-7ff81f4a7c76 2066->2072 2073 7ff81f4a7c78 2066->2073 2067->2068 2075 7ff81f4a7c8b-7ff81f4a7ca0 strncmp 2067->2075 2068->2050 2077 7ff81f4a7cc4-7ff81f4a7cd9 strncmp 2068->2077 2070->2050 2071->2058 2072->2050 2073->2061 2079 7ff81f4a7ca2-7ff81f4a7cb5 2075->2079 2080 7ff81f4a7cb7 2075->2080 2077->2050 2078 7ff81f4a7cdb-7ff81f4a7ceb 2077->2078 2078->2050 2079->2050 2080->2068 2091 7ff81f4a7de4-7ff81f4a7e00 call 7ff81f4dac60 2089->2091 2092 7ff81f4a7e16-7ff81f4a7e2d call 7ff81f4ab480 call 7ff81f4db2e0 2089->2092 2093 7ff81f4a813c-7ff81f4a8162 2090->2093 2091->2092 2098 7ff81f4a7e02-7ff81f4a7e0e 2091->2098 2101 7ff81f4a7e4d-7ff81f4a7e52 2092->2101 2102 7ff81f4a7e2f-7ff81f4a7e40 call 7ff81f4dac60 2092->2102 2098->2092 2104 7ff81f4a7e54-7ff81f4a7e64 call 7ff81f4514f0 2101->2104 2105 7ff81f4a7e6a-7ff81f4a7e72 2101->2105 2108 7ff81f4a7e45-7ff81f4a7e4b 2102->2108 2104->2105 2114 7ff81f4a812f-7ff81f4a8132 call 7ff81f513b60 2104->2114 2106 7ff81f4a7e74-7ff81f4a7e8a call 7ff81f4dac60 2105->2106 2107 7ff81f4a7e8d-7ff81f4a7e90 2105->2107 2106->2107 2111 7ff81f4a7eb0-7ff81f4a7ebe 2107->2111 2112 7ff81f4a7e92-7ff81f4a7eae call 7ff81f4dac60 2107->2112 2108->2101 2108->2105 2117 7ff81f4a7ec3-7ff81f4a7ec6 2111->2117 2112->2111 2124 7ff81f4a7ec0 2112->2124 2114->2090 2120 7ff81f4a7f36-7ff81f4a7f39 2117->2120 2121 7ff81f4a7ec8-7ff81f4a7eef call 7ff81f511dd0 2117->2121 2122 7ff81f4a7f62-7ff81f4a7f76 2120->2122 2123 7ff81f4a7f3b-7ff81f4a7f51 call 7ff81f512490 2120->2123 2121->2114 2132 7ff81f4a7ef5-7ff81f4a7eff 2121->2132 2130 7ff81f4a7f84-7ff81f4a7fa2 2122->2130 2131 7ff81f4a7f78-7ff81f4a7f82 2122->2131 2123->2114 2133 7ff81f4a7f57-7ff81f4a7f5d call 7ff81f514940 2123->2133 2124->2117 2134 7ff81f4a7fb9-7ff81f4a803d memset 2130->2134 2135 7ff81f4a7fa4-7ff81f4a7fab 2130->2135 2131->2130 2131->2134 2132->2120 2136 7ff81f4a7f01-7ff81f4a7f28 2132->2136 2133->2122 2142 7ff81f4a8050-7ff81f4a809b call 7ff81f49fa40 call 7ff81f496bf0 2134->2142 2143 7ff81f4a803f-7ff81f4a8049 2134->2143 2135->2134 2139 7ff81f4a7fad-7ff81f4a7fb4 2135->2139 2136->2120 2137 7ff81f4a7f2a-7ff81f4a7f30 2136->2137 2137->2120 2139->2134 2142->2114 2148 7ff81f4a80a1-7ff81f4a80c6 call 7ff81f4a86a0 2142->2148 2143->2142 2148->2114 2151 7ff81f4a80c8-7ff81f4a80ce 2148->2151 2152 7ff81f4a80d4-7ff81f4a80dc 2151->2152 2153 7ff81f4a818f-7ff81f4a8193 2151->2153 2156 7ff81f4a80e2-7ff81f4a8126 2152->2156 2157 7ff81f4a8187-7ff81f4a818a call 7ff81f451770 2152->2157 2154 7ff81f4a8195-7ff81f4a81a3 2153->2154 2155 7ff81f4a81ac-7ff81f4a81c9 call 7ff81f4d8fa0 2153->2155 2154->2155 2155->2093 2156->2114 2157->2153
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: -class$-colormap$-screen$-use$-visual$CONTAINMENT$Class$Colormap$FRAME$Use$Visual$class$colormap$use$v$visual$windows cannot have both the -use and the -container option set$b6
                                                                                                                                                                                                                                                  • API String ID: 1114863663-3606458496
                                                                                                                                                                                                                                                  • Opcode ID: 4d02020b86d784ae3018efff9a55b68e44859e77d7aba6e6cae09c7c0469aa18
                                                                                                                                                                                                                                                  • Instruction ID: 30a8c8c78c9b847d6c9b0bcacd018afc3578afef973b99d4352e65e3f1ebf660
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4d02020b86d784ae3018efff9a55b68e44859e77d7aba6e6cae09c7c0469aa18
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34F16775A09F8296EB64DB12E8502B923A5FB49BE4F084236DE4F077A5DF3CE464C344
                                                                                                                                                                                                                                                  Function 00007FF81F44F420 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 231windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 2164 7ff81f44f420-7ff81f44f45c call 7ff81f44e980 2166 7ff81f44f461-7ff81f44f4a8 SetROP2 CreateCompatibleDC 2164->2166 2167 7ff81f44f4ae-7ff81f44f4b2 2166->2167 2168 7ff81f44f5c4-7ff81f44f5d6 2166->2168 2169 7ff81f44f4df-7ff81f44f4ea 2167->2169 2170 7ff81f44f4b4-7ff81f44f4b8 2167->2170 2171 7ff81f44f5dd-7ff81f44f61a 2168->2171 2172 7ff81f44f5d8 2168->2172 2174 7ff81f44f4ec-7ff81f44f4f1 2169->2174 2175 7ff81f44f4f3-7ff81f44f4f5 2169->2175 2170->2169 2173 7ff81f44f4ba-7ff81f44f4da CreateBitmap 2170->2173 2181 7ff81f44f61c-7ff81f44f624 2171->2181 2182 7ff81f44f659 2171->2182 2172->2171 2176 7ff81f44f5a5-7ff81f44f5bf SetTextColor SetBkColor 2173->2176 2174->2175 2177 7ff81f44f4f7-7ff81f44f4fe 2175->2177 2178 7ff81f44f500-7ff81f44f521 2175->2178 2180 7ff81f44f68d-7ff81f44f690 2176->2180 2177->2178 2190 7ff81f44f57d-7ff81f44f59b CreateBitmap 2178->2190 2191 7ff81f44f523-7ff81f44f527 2178->2191 2184 7ff81f44f692-7ff81f44f699 2180->2184 2185 7ff81f44f6a3-7ff81f44f75a SelectObject BitBlt SelectObject DeleteObject DeleteDC SetBkMode SelectPalette RealizePalette 2180->2185 2183 7ff81f44f65d-7ff81f44f683 CreateDIBitmap 2181->2183 2187 7ff81f44f626-7ff81f44f62d 2181->2187 2182->2183 2183->2180 2184->2185 2188 7ff81f44f75c-7ff81f44f769 ReleaseDC 2185->2188 2189 7ff81f44f76b-7ff81f44f76e 2185->2189 2192 7ff81f44f630-7ff81f44f655 2187->2192 2193 7ff81f44f779-7ff81f44f798 2188->2193 2189->2193 2194 7ff81f44f770-7ff81f44f773 DeleteDC 2189->2194 2190->2176 2195 7ff81f44f530-7ff81f44f542 2191->2195 2192->2192 2196 7ff81f44f657 2192->2196 2194->2193 2197 7ff81f44f544-7ff81f44f547 2195->2197 2198 7ff81f44f572-7ff81f44f57b 2195->2198 2196->2183 2199 7ff81f44f54d-7ff81f44f551 2197->2199 2200 7ff81f44f549-7ff81f44f54b 2197->2200 2198->2190 2198->2195 2202 7ff81f44f560 2199->2202 2203 7ff81f44f553-7ff81f44f55e 2199->2203 2201 7ff81f44f566-7ff81f44f570 2200->2201 2201->2197 2201->2198 2204 7ff81f44f563 2202->2204 2203->2204 2204->2201
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CreatePaletteSelect$BitmapDeleteObject$ColorModeRealize$CompatibleReleaseText
                                                                                                                                                                                                                                                  • String ID: $Fail to allocate bitmap
                                                                                                                                                                                                                                                  • API String ID: 455095717-3619745282
                                                                                                                                                                                                                                                  • Opcode ID: 8778ffbcff5a117a04fd0fb90c51e92b525907cc7f02fb073bf2ac4a14a943ee
                                                                                                                                                                                                                                                  • Instruction ID: e8e7ab770d7f945864e29cee43c145a5497810e0e93d1cfc3918f19675ee7697
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8778ffbcff5a117a04fd0fb90c51e92b525907cc7f02fb073bf2ac4a14a943ee
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CEA1AE36608A8186E724CF25E91467977B5FB88BE4F148235DE8E53765CF3CE456CB00
                                                                                                                                                                                                                                                  Function 00007FF6C6471950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 2546 7ff6c6471950-7ff6c647198b call 7ff6c64745c0 2549 7ff6c6471991-7ff6c64719d1 call 7ff6c6477f90 2546->2549 2550 7ff6c6471c4e-7ff6c6471c72 call 7ff6c647c550 2546->2550 2555 7ff6c6471c3b-7ff6c6471c3e call 7ff6c648004c 2549->2555 2556 7ff6c64719d7-7ff6c64719e7 call 7ff6c64806d4 2549->2556 2559 7ff6c6471c43-7ff6c6471c4b 2555->2559 2561 7ff6c6471a08-7ff6c6471a24 call 7ff6c648039c 2556->2561 2562 7ff6c64719e9-7ff6c6471a03 call 7ff6c6484f08 call 7ff6c6472910 2556->2562 2559->2550 2568 7ff6c6471a26-7ff6c6471a40 call 7ff6c6484f08 call 7ff6c6472910 2561->2568 2569 7ff6c6471a45-7ff6c6471a5a call 7ff6c6484f28 2561->2569 2562->2555 2568->2555 2576 7ff6c6471a5c-7ff6c6471a76 call 7ff6c6484f08 call 7ff6c6472910 2569->2576 2577 7ff6c6471a7b-7ff6c6471b05 call 7ff6c6471c80 * 2 call 7ff6c64806d4 call 7ff6c6484f44 2569->2577 2576->2555 2590 7ff6c6471b0a-7ff6c6471b14 2577->2590 2591 7ff6c6471b16-7ff6c6471b30 call 7ff6c6484f08 call 7ff6c6472910 2590->2591 2592 7ff6c6471b35-7ff6c6471b4e call 7ff6c648039c 2590->2592 2591->2555 2598 7ff6c6471b50-7ff6c6471b6a call 7ff6c6484f08 call 7ff6c6472910 2592->2598 2599 7ff6c6471b6f-7ff6c6471b8b call 7ff6c6480110 2592->2599 2598->2555 2606 7ff6c6471b8d-7ff6c6471b99 call 7ff6c6472710 2599->2606 2607 7ff6c6471b9e-7ff6c6471bac 2599->2607 2606->2555 2607->2555 2608 7ff6c6471bb2-7ff6c6471bb9 2607->2608 2611 7ff6c6471bc1-7ff6c6471bc7 2608->2611 2613 7ff6c6471bc9-7ff6c6471bd6 2611->2613 2614 7ff6c6471be0-7ff6c6471bef 2611->2614 2615 7ff6c6471bf1-7ff6c6471bfa 2613->2615 2614->2614 2614->2615 2616 7ff6c6471bfc-7ff6c6471bff 2615->2616 2617 7ff6c6471c0f 2615->2617 2616->2617 2618 7ff6c6471c01-7ff6c6471c04 2616->2618 2619 7ff6c6471c11-7ff6c6471c24 2617->2619 2618->2617 2620 7ff6c6471c06-7ff6c6471c09 2618->2620 2621 7ff6c6471c2d-7ff6c6471c39 2619->2621 2622 7ff6c6471c26 2619->2622 2620->2617 2623 7ff6c6471c0b-7ff6c6471c0d 2620->2623 2621->2555 2621->2611 2622->2621 2623->2619
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6477F90: _fread_nolock.LIBCMT ref: 00007FF6C647803A
                                                                                                                                                                                                                                                  • _fread_nolock.LIBCMT ref: 00007FF6C6471A1B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6C6471B6A), ref: 00007FF6C647295E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                                  • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                                  • Opcode ID: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
                                                                                                                                                                                                                                                  • Instruction ID: db9cfe08b533094ee5ceb4d7477df78db645f29699f59f5ce95e093536caf683
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37816F71A18686C5EB62DF24D0402BA33A1EF88746F44C436DACDC7796DE3EE545C748
                                                                                                                                                                                                                                                  Function 00007FF81F39FF60 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 89memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                                  control_flow_graph 2624 7ff81f39ff60-7ff81f39ff63 2625 7ff81f3a0017 2624->2625 2626 7ff81f39ff69-7ff81f39ff78 2624->2626 2627 7ff81f39ff9b 2626->2627 2628 7ff81f39ff7a-7ff81f39ff93 TlsAlloc 2626->2628 2631 7ff81f39ffa1-7ff81f39ffb4 TlsGetValue 2627->2631 2629 7ff81f3a0092-7ff81f3a009e call 7ff81f37a3f0 2628->2629 2630 7ff81f39ff99 2628->2630 2636 7ff81f3a009f-7ff81f3a00ab call 7ff81f37a3f0 2629->2636 2630->2631 2632 7ff81f39ffc4-7ff81f39ffc7 2631->2632 2633 7ff81f39ffb6-7ff81f39ffbe GetLastError 2631->2633 2637 7ff81f39ffd1-7ff81f39ffdb 2632->2637 2638 7ff81f39ffc9-7ff81f39ffce call 7ff81f39fc10 2632->2638 2633->2632 2633->2636 2639 7ff81f39ffe1-7ff81f39ffe4 2637->2639 2640 7ff81f3a007a-7ff81f3a0091 call 7ff81f37a3f0 2637->2640 2638->2637 2639->2640 2643 7ff81f39ffea-7ff81f39fff1 2639->2643 2640->2629 2647 7ff81f39fff3-7ff81f3a0007 GetProcessHeap HeapFree 2643->2647 2648 7ff81f3a0018-7ff81f3a0038 2643->2648 2650 7ff81f3a000d-7ff81f3a0016 2647->2650 2651 7ff81f3a003a 2648->2651 2652 7ff81f3a003e-7ff81f3a004f 2648->2652 2650->2625 2651->2652 2652->2650 2653 7ff81f3a0051-7ff81f3a0061 2652->2653 2653->2650 2654 7ff81f3a0063-7ff81f3a0075 2653->2654
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Heap$AllocErrorFreeLastProcessValue
                                                                                                                                                                                                                                                  • String ID: %lu %ld %ld %ld %ld %ld %ld$TlsGetValue failed from TclpGetAllocCache$alloc: could not allocate %d new objects$alloc: invalid block: %p: %x %x$could not allocate thread local storage$shared$thread%p
                                                                                                                                                                                                                                                  • API String ID: 3216287067-481911188
                                                                                                                                                                                                                                                  • Opcode ID: ceadf114651b69407d8bcb6e4ce65807e35d45e9b28e9736e2892df6b4dd9150
                                                                                                                                                                                                                                                  • Instruction ID: 08a70e3a0be7a5e80fb6e84aac92314d8b45fbc530981f5bf06d87f396d2e388
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ceadf114651b69407d8bcb6e4ce65807e35d45e9b28e9736e2892df6b4dd9150
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D341A271A09E428AEB50CB2AA84053877A0FF55BF4F144331D95D8B6A5DF3DE466CB00
                                                                                                                                                                                                                                                  Function 00007FF81F453990 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 156COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CharObjectSelectTextWidth$FaceMetricsRelease
                                                                                                                                                                                                                                                  • String ID: unicode$utf-16
                                                                                                                                                                                                                                                  • API String ID: 1149465119-3317161374
                                                                                                                                                                                                                                                  • Opcode ID: 859dd0d45fd38309a820ea38a72e84e0938acd80e00ccf0593fc54d9665a01c0
                                                                                                                                                                                                                                                  • Instruction ID: 83344ec85becb857a1895025f6242f5045ebcfdcb24a1aa148f7c1bfbd85de9e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 859dd0d45fd38309a820ea38a72e84e0938acd80e00ccf0593fc54d9665a01c0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6A715D72608E8686DB15DF26E8502B977A5FB48BE4F044236DE8E43765DF3CD496C700
                                                                                                                                                                                                                                                  Function 00007FF81F4C0A90 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 191COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF81F4C0B2D
                                                                                                                                                                                                                                                  • _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81F4C0BC0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _strnicmp
                                                                                                                                                                                                                                                  • String ID: -data option isn't supported for %s images$IMAGE$LOOKUP$NOT_DATA_FORMAT$PHOTO$PHOTO_FORMAT$UNRECOGNIZED_DATA$couldn't recognize image data$image format "%s" is not supported
                                                                                                                                                                                                                                                  • API String ID: 2635805826-3952471749
                                                                                                                                                                                                                                                  • Opcode ID: fe8a1428c86a6f4c259cb3c0ceaaefa02c52ef0184d486d7fe044d9d392678df
                                                                                                                                                                                                                                                  • Instruction ID: 4a11a2242d200be16f360ea742ff06170eba906d9a25b1d0c9c8be4d179f7154
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fe8a1428c86a6f4c259cb3c0ceaaefa02c52ef0184d486d7fe044d9d392678df
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F3914C66A08F8285EB548F16E8503A973A4FB49BE8F445731CE5E87398DF3CE555C300
                                                                                                                                                                                                                                                  Function 00007FF6C6471470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                  • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                  • Opcode ID: 0415811bb7329ddca4e4a244178c4befdf0ff72a6341d4c7f046017dd740e2c3
                                                                                                                                                                                                                                                  • Instruction ID: 97e75146680269b543ce9d7abee77d62c3ba6486f618ea03006fd3641f642cce
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0415811bb7329ddca4e4a244178c4befdf0ff72a6341d4c7f046017dd740e2c3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6D41B121B18642C6EB16DF21A5005BA7390FF58789F48C532EE8DD7B95DE3EE501C748
                                                                                                                                                                                                                                                  Function 00007FF6C6471210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                                  • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                                  • Opcode ID: 698b21169e7bd12c857e57f237555d9e116291535cd7e4395843bf29195d2337
                                                                                                                                                                                                                                                  • Instruction ID: ef0f3bb399a0486cb6d11b62cd5ddd4fe1ae5751303d06608b5186ec3b3020d3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 698b21169e7bd12c857e57f237555d9e116291535cd7e4395843bf29195d2337
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C51F922A0864281E662AF11A4403BA7391FF85B96F48C135EECDC7BD5EF3DE505C748
                                                                                                                                                                                                                                                  Function 00007FF81F45D690 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113registrywindowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: HandleLoadModule$ClassCursorIconRegister
                                                                                                                                                                                                                                                  • String ID: TkTopLevel$Unable to register TkTopLevel class
                                                                                                                                                                                                                                                  • API String ID: 1220223050-2494010311
                                                                                                                                                                                                                                                  • Opcode ID: d95be2fde495b25a383373344f9ea24be3c5431bd0b544cf80a4d0b24179be97
                                                                                                                                                                                                                                                  • Instruction ID: 8c5f6701cbe35d5133566cbfe6eca3fd4caad406b928107c0ea3866c67aa92b4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d95be2fde495b25a383373344f9ea24be3c5431bd0b544cf80a4d0b24179be97
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92513975A08F4282EB599B10E8542B977B4FF84BE0F11423AD99E47764DF3CE896C740
                                                                                                                                                                                                                                                  Function 00007FF81F3A0280 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Alloc$ErrorHeapLastValue$CriticalLeaveProcessSection
                                                                                                                                                                                                                                                  • String ID: alloc: could not allocate %d new objects
                                                                                                                                                                                                                                                  • API String ID: 4183754528-1866737643
                                                                                                                                                                                                                                                  • Opcode ID: 8e3c70295d4e6dc4cc6b8ab5dd1595e84d9ca708e68755de6ff6b0f6283c91b9
                                                                                                                                                                                                                                                  • Instruction ID: 30f88d1998d9f09efe50fa5d8808055bdd5196d7f1f77cf2b0192ac634f6de8d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8e3c70295d4e6dc4cc6b8ab5dd1595e84d9ca708e68755de6ff6b0f6283c91b9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B5411CB2A09F0287EB548F26E84423973A0FB58BE4F140235CA4D8B795DF3CD565C740
                                                                                                                                                                                                                                                  Function 00007FF6C64736B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF6C6473804), ref: 00007FF6C64736E1
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,00007FF6C6473804), ref: 00007FF6C64736EB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C6473706,?,00007FF6C6473804), ref: 00007FF6C6472C9E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C6473706,?,00007FF6C6473804), ref: 00007FF6C6472D63
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6472C50: MessageBoxW.USER32 ref: 00007FF6C6472D99
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                                  • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                                  • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                  • Instruction ID: 27eaa4ede51a19cc61983e1c7c9b2b5aa2253bd4d4b0732632e0587962cbdae9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 56219261B1C64291FB33AF24E8153BA3255BF8835AF80C236E6DDC65D5EE2EE504C748
                                                                                                                                                                                                                                                  Function 00007FF81F3052A0 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 305COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A028D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02BB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02C9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A036B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A037E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A038F
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F3053D5
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32 ref: 00007FF81F30545C
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32 ref: 00007FF81F3056AC
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32 ref: 00007FF81F3056E0
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalLeaveSection$AllocHeap$ErrorLastProcessValuememcpy
                                                                                                                                                                                                                                                  • String ID: FreeEncoding: refcount problem !!!$concurrent dictionary modification and search$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 1241236031-687981174
                                                                                                                                                                                                                                                  • Opcode ID: 7f6206a6c975172b86ecbc59c66844c01de192cd9ef3f674faac92eb5c0bb769
                                                                                                                                                                                                                                                  • Instruction ID: c83169e5e4ba7b10f12712970f6f4e8f81da012c62b7a52527ef8a79bbabf0e4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7f6206a6c975172b86ecbc59c66844c01de192cd9ef3f674faac92eb5c0bb769
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1FD16A36A09E4286EB54DF65E4802BD23A1FF84BE4F444236DE1E4BB95DF38E466C340
                                                                                                                                                                                                                                                  Function 00007FF6C648BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
                                                                                                                                                                                                                                                  • Instruction ID: fc83454745ad798bc3d4a0f3e74a2395c581143f6974aae153c54d30337fc3d3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FBC1E72290C78699E6629F1590402BE3791FF89B81F55C136EACDC37A1CF7EE445C788
                                                                                                                                                                                                                                                  Function 00007FF81F465C00 Relevance: 10.7, APIs: 7, Instructions: 225windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CompositionContextString$CountMessageProcReleaseSendTickWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 568510177-0
                                                                                                                                                                                                                                                  • Opcode ID: 3af1a7b433b6aa20c32006c3ac12bcb407cb63fe6fd156464f24aec8048010e5
                                                                                                                                                                                                                                                  • Instruction ID: e4460a475d7187bd1ab4f0cef3c8c8bae91fe435cc0c83e4aff75ab1ea79d2d3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3af1a7b433b6aa20c32006c3ac12bcb407cb63fe6fd156464f24aec8048010e5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 31A18F22F18F4286E754CB69A4442BC37A1FB887F8F144235EE4D437A5EE3CE4A58700
                                                                                                                                                                                                                                                  Function 00007FF81F465250 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 206windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$ClientLongMovePlacementRectVisible
                                                                                                                                                                                                                                                  • String ID: ,
                                                                                                                                                                                                                                                  • API String ID: 2284278383-3772416878
                                                                                                                                                                                                                                                  • Opcode ID: 5677b9517fb50ca5eb19b2c0f0437919f7ba2252812a8755d2510d2bf76a121a
                                                                                                                                                                                                                                                  • Instruction ID: 7b1a14356406f72b7a3d6b2b90aec5096cf9fd6ab756ab225f5c115decb2f808
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5677b9517fb50ca5eb19b2c0f0437919f7ba2252812a8755d2510d2bf76a121a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 29A13E76B04A828BE768CF39E54476C77A0FB84BA4F144236DB5D47698DF38E4A1CB40
                                                                                                                                                                                                                                                  Function 00007FF81F3AD510 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 191COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalLeaveSection
                                                                                                                                                                                                                                                  • String ID: FreeEncoding: refcount problem !!!$PGV Initializer did not initialize$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3988221542-1397560407
                                                                                                                                                                                                                                                  • Opcode ID: ef5bacd6ce5cc0d2d441c437a328647c6b14078078c497b3031e6937a62b64e9
                                                                                                                                                                                                                                                  • Instruction ID: 10484ff031918cf94da52735d42675cd9e85fc056c5f4c7046e0602b6a869732
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ef5bacd6ce5cc0d2d441c437a328647c6b14078078c497b3031e6937a62b64e9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CC716432A09E4296EA14EF52E9642BD6360FF84BE4F044635DB1E8B795DF3CE461C340
                                                                                                                                                                                                                                                  Function 00007FF81F453E40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 138COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ObjectSelect$FaceTextmemset
                                                                                                                                                                                                                                                  • String ID: unicode$utf-16
                                                                                                                                                                                                                                                  • API String ID: 920176757-3317161374
                                                                                                                                                                                                                                                  • Opcode ID: e7e2d39dda480d17febe76ba2aea890b954c2e7c0901f282c8aa1a49deda5bbe
                                                                                                                                                                                                                                                  • Instruction ID: e198a0351e3c5dd0e9b6dae2a2daee4840b2a95d905bee45d60b331faa46b598
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e7e2d39dda480d17febe76ba2aea890b954c2e7c0901f282c8aa1a49deda5bbe
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 21516A76A09F4691EA589B12E8543BA73B5FB48BE0F048235DE5E07765DF3CE0A5C340
                                                                                                                                                                                                                                                  Function 00007FF6C6476360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                                                                                                  • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                                  • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                                  • Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                                                                  • Instruction ID: c42a39f4658a5f13c7b853550fdc7dcc0d361c1837a0a3dd550dabd3a764d2c4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3F418031A1CA8691EA16DF20E5141EA7365FF44386F90C132DADC83696EF3DE609C748
                                                                                                                                                                                                                                                  Function 00007FF81F4468D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$CreateHandleLongModule
                                                                                                                                                                                                                                                  • String ID: BUTTON$STATIC
                                                                                                                                                                                                                                                  • API String ID: 4115577067-3385952364
                                                                                                                                                                                                                                                  • Opcode ID: 2bed71731eab65cce4ab4e9f0e18d46ba4b275ff4e7492dc4a64f194afd80a3f
                                                                                                                                                                                                                                                  • Instruction ID: 2dd2e50b079391219624c6f0397ec870f8e0aef3a8f425f723452f9927b3200f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2bed71731eab65cce4ab4e9f0e18d46ba4b275ff4e7492dc4a64f194afd80a3f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3631FB76608B818BD754CF25E84065AB7E4F748B94F144236EA8D93B28DF38D492CB00
                                                                                                                                                                                                                                                  Function 00007FF81F353730 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 429COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                                                  • String ID: LIST$concurrent dictionary modification and search$list$max size for a Tcl value (%d bytes) exceeded$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3510742995-4178152732
                                                                                                                                                                                                                                                  • Opcode ID: d8ceee3f577477c7c071ef1e3f1d4bc17441ffeefaa09526e67d1a9caa9dd99b
                                                                                                                                                                                                                                                  • Instruction ID: 0e60f1327051e423ee120ea3d871a5e4e6ee3ed15e5228b6e5740287ef263e18
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d8ceee3f577477c7c071ef1e3f1d4bc17441ffeefaa09526e67d1a9caa9dd99b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0902C072A09F8686EB64CB15D4902B973A2FB84BE4F148235DE4E4B7A5DF3CE445C740
                                                                                                                                                                                                                                                  Function 00007FF81F4BA940 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 94COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memset$_stricmp
                                                                                                                                                                                                                                                  • String ID: IMAGE$PNG$ZLIB_INIT$zlib initialization failed
                                                                                                                                                                                                                                                  • API String ID: 3026489053-4061978001
                                                                                                                                                                                                                                                  • Opcode ID: 5c1e9e4833572b630bd5c8ea07bf2014429ef1a6a9226aa2c39e0d034d789c0e
                                                                                                                                                                                                                                                  • Instruction ID: 27f53f7f1509b4fcd4f29e20e0e760c46a8d7e1f5d15ded5f2abb19d6b85674a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5c1e9e4833572b630bd5c8ea07bf2014429ef1a6a9226aa2c39e0d034d789c0e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 12415E76A08E8282EB109B15E9407F973A5FB88BE5F444231DE4D47B5ADF3CD555CB00
                                                                                                                                                                                                                                                  Function 00007FF81F44E980 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Palette$ModeRealizeSelect
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3073415821-0
                                                                                                                                                                                                                                                  • Opcode ID: 06f0baecdb756decac43179160e73aa0f29262ddb9304ed7c5d09c55bc936182
                                                                                                                                                                                                                                                  • Instruction ID: fa05f6339d1fcb151438d8309e82da0a71528931281020952b65cbe38d0a0e4f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 06f0baecdb756decac43179160e73aa0f29262ddb9304ed7c5d09c55bc936182
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8331F866A18F91C2DA58CB16E8842A9A364F749FD0F189532DE4E67765CF38D4A2C300
                                                                                                                                                                                                                                                  Function 00007FF81F515F50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$ColorLongProc
                                                                                                                                                                                                                                                  • String ID: #%04X%04X%04X$Ttk
                                                                                                                                                                                                                                                  • API String ID: 3223664542-2938447076
                                                                                                                                                                                                                                                  • Opcode ID: b7beb31e0df3b080ec4497e91dcc1c8f8241d996f3c89413baac79b945f63759
                                                                                                                                                                                                                                                  • Instruction ID: a66e07ce7f30e2703b261f99ff9c0bca71ccb86c1a94c2369ec71443a8ed98ca
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b7beb31e0df3b080ec4497e91dcc1c8f8241d996f3c89413baac79b945f63759
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 67518E76608F9682E7048B15E8503BA77A5FB84BE4F449232EE8D43769DF3CE455CB40
                                                                                                                                                                                                                                                  Function 00007FF81F339360 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 322COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Valuememcpy
                                                                                                                                                                                                                                                  • String ID: binary encoding is not available$iso8859-1$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 574835123-1438692910
                                                                                                                                                                                                                                                  • Opcode ID: 695922e2a6b935bdb02a1253ee56081dbbc8357c881035a019df89dc630ae0df
                                                                                                                                                                                                                                                  • Instruction ID: 1f2da859d18d11bf98149732224672c2895d23009db6a99256dfd4019c72ea59
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 695922e2a6b935bdb02a1253ee56081dbbc8357c881035a019df89dc630ae0df
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BEE18F32A09B81C6DB60CF15E4447AEB3A5FB88BA4F158239DE8D87758DF38D494CB40
                                                                                                                                                                                                                                                  Function 00007FF81F28DEC0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 298COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32 ref: 00007FF81F28DF04
                                                                                                                                                                                                                                                  • memset.VCRUNTIME140 ref: 00007FF81F28DF50
                                                                                                                                                                                                                                                  • memset.VCRUNTIME140 ref: 00007FF81F28E0CB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F28E298
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeapValuememset$ErrorLastProcessmemcpy
                                                                                                                                                                                                                                                  • String ID: unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3648771258-2759121943
                                                                                                                                                                                                                                                  • Opcode ID: 6db8921162cc918dd76de3ae08dd89d313ca2f63018753ea8b8575ce182c3b29
                                                                                                                                                                                                                                                  • Instruction ID: 4a4d167cf3771490f016cec882f76922e9a04a58aa331b922f9ae3db1fe73147
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6db8921162cc918dd76de3ae08dd89d313ca2f63018753ea8b8575ce182c3b29
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 81C16872A09E4685EB24DF65E4902BA63A0FB84BE8F484735DE5E17799DF3CE841C340
                                                                                                                                                                                                                                                  Function 00007FF81F474570 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 272COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DeleteObject
                                                                                                                                                                                                                                                  • String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup$gray50
                                                                                                                                                                                                                                                  • API String ID: 1531683806-823200916
                                                                                                                                                                                                                                                  • Opcode ID: d4f61a2dd53c3e6ce4fb164659ece5fc940a58531a88d74beaac1fd3d70e014c
                                                                                                                                                                                                                                                  • Instruction ID: 7d4457508dddafb78cf531a4e0450756c06b81c2e5d30f4ebb1cca61d45a1a00
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d4f61a2dd53c3e6ce4fb164659ece5fc940a58531a88d74beaac1fd3d70e014c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 24E10076A04B81CAEB20CF65D4407AD37B5FB88B98F418226CE5D97768DF38D465C740
                                                                                                                                                                                                                                                  Function 00007FF81F453C50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DeleteObject
                                                                                                                                                                                                                                                  • String ID: unicode$utf-16
                                                                                                                                                                                                                                                  • API String ID: 1531683806-3317161374
                                                                                                                                                                                                                                                  • Opcode ID: 0756e2dfd691b1e934e4e5270af3a6727ba5a6b5723d1195d0da5b99e0b33e8b
                                                                                                                                                                                                                                                  • Instruction ID: 7ee1e4fbfcee48f76b589442792915157b8e2e46afa93618c82709d442d6c140
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0756e2dfd691b1e934e4e5270af3a6727ba5a6b5723d1195d0da5b99e0b33e8b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 20514C7AA1AF46C2DA449B16E95427977B9FB84FD0F049635CE4E03761DF38E469C300
                                                                                                                                                                                                                                                  Function 00007FF81F45BCA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Focus$ForegroundWindow
                                                                                                                                                                                                                                                  • String ID: ChangeXFocus got null X window
                                                                                                                                                                                                                                                  • API String ID: 332191172-2759626269
                                                                                                                                                                                                                                                  • Opcode ID: 79e415d5b7c09eb9aba549897e044710052940487d3eed8ec156a0d58408c175
                                                                                                                                                                                                                                                  • Instruction ID: 25e05c3edc14af6688be8a212eafde1504dd6b66282c3c1ce97b21e7ca97f20e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 79e415d5b7c09eb9aba549897e044710052940487d3eed8ec156a0d58408c175
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A421DB36A09E81C5EB58DF16E45026963B0FB88FE4F189236DE4E47769DF38D896C700
                                                                                                                                                                                                                                                  Function 00007FF81F45CDA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window$CreateHandleModule
                                                                                                                                                                                                                                                  • String ID: TkChild
                                                                                                                                                                                                                                                  • API String ID: 1084761317-227893619
                                                                                                                                                                                                                                                  • Opcode ID: c9fe2abb82e580163a2428423a825b6c84ae4f00c944f8885d94c984aa77f129
                                                                                                                                                                                                                                                  • Instruction ID: d064b7d56037cc10872f67779d0aee49d64a50ad028b7e8bf4894633462344ad
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c9fe2abb82e580163a2428423a825b6c84ae4f00c944f8885d94c984aa77f129
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D921DB76A08B8187E764CF29E44465ABBE0F748BD4F144239EB8983B28DF3CE4518B00
                                                                                                                                                                                                                                                  Function 00007FF81F3542F0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140(?,00000000,00000000,00007FF81F354114,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF81F354385
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$ErrorLastProcessValuememcpy
                                                                                                                                                                                                                                                  • String ID: max size of Tcl literal array (%d literals) exceeded$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 1456920652-186258196
                                                                                                                                                                                                                                                  • Opcode ID: c7ed0dc1b8ea92c79c86869e00f86b8ceae28230a872a43ceedaea15fac226aa
                                                                                                                                                                                                                                                  • Instruction ID: a4258bf9d64de9515536c3a8ba85efaa16d6591f3b7acf8cdc75eed69d2a1d13
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c7ed0dc1b8ea92c79c86869e00f86b8ceae28230a872a43ceedaea15fac226aa
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 10318572F09B4286EA548F15D42137922A1AFD1BF4F584735DA2E4F7E9DF3CE4528600
                                                                                                                                                                                                                                                  Function 00007FF6C6485628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1279662727-0
                                                                                                                                                                                                                                                  • Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
                                                                                                                                                                                                                                                  • Instruction ID: 699bdd84fb586f7e2aca47ccd13fc25c1cf4ff7807229c925fd8ed329aaee408
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6E41A122D1878183E7559F2095103797760FBA87A9F10D336EADC83AE1DF7DA5E08784
                                                                                                                                                                                                                                                  Function 00007FF81F3CB2B0 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CommConsoleErrorFileLastModeStateType
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3984557487-0
                                                                                                                                                                                                                                                  • Opcode ID: 362d8e4a3f460dfc9f25ef1ce9f2f67178088f0cf2c9bc588b7a476edcd8b8e4
                                                                                                                                                                                                                                                  • Instruction ID: fcd17102877a1e185c6d8be83feb24ade0a71b17f115abf8bf422c800f59a352
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 362d8e4a3f460dfc9f25ef1ce9f2f67178088f0cf2c9bc588b7a476edcd8b8e4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B201483170CE4581F7549B15B84463B77A5EF48BE4F440235DA4E8A655DF2CE8489A05
                                                                                                                                                                                                                                                  Function 00007FF81F345D80 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _errno
                                                                                                                                                                                                                                                  • String ID: ctory$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2918714741-474272330
                                                                                                                                                                                                                                                  • Opcode ID: ccd2594befbd4f33e43b85d7151a739855d0460ea5844fecccedaa337c2535dd
                                                                                                                                                                                                                                                  • Instruction ID: fd1d7abef4a2b3688ecee79f02fee1eeb81ea982239db3b1b6c7b2ff49dcccb4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ccd2594befbd4f33e43b85d7151a739855d0460ea5844fecccedaa337c2535dd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DCA19D62A0DF4286EB659F2698402B9A7A0FF84BE4F444635DE4D4BBD2DF3CE485D700
                                                                                                                                                                                                                                                  Function 00007FF81F4BCDE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CreateDeleteIndirectObjectRectstrncmp
                                                                                                                                                                                                                                                  • String ID: tried to delete photo image when instances still exist
                                                                                                                                                                                                                                                  • API String ID: 3169462253-2722655475
                                                                                                                                                                                                                                                  • Opcode ID: 419782726299dbf6c91504e9da5d62b8177e7300e44eba71a79a818844e047fc
                                                                                                                                                                                                                                                  • Instruction ID: 34eae05613a1db858e0b2a880cc94c027b91c9023d7eefc2682bb49bf36d2bb6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 419782726299dbf6c91504e9da5d62b8177e7300e44eba71a79a818844e047fc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A517F76A19F8282EA50CF16E8946B933A9FB98BD5F069371DE4D47361EF38D095C300
                                                                                                                                                                                                                                                  Function 00007FF81F2F1830 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 202stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: ::tcl$::tcl::
                                                                                                                                                                                                                                                  • API String ID: 1114863663-1364682314
                                                                                                                                                                                                                                                  • Opcode ID: 943dc0c8eccb0eb317abf2f67db4ac8d4f5993c13e26ae899a38f203fb1638a4
                                                                                                                                                                                                                                                  • Instruction ID: 905a438c55bc52115fd23f2cf5128614535ac73738b42a368956517f1e8bbd18
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 943dc0c8eccb0eb317abf2f67db4ac8d4f5993c13e26ae899a38f203fb1638a4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 03818E32B18B8586EB51CF25E4406A977A0FB89BD8F944136DE4D5BB9CDF38D941CB00
                                                                                                                                                                                                                                                  Function 00007FF81F465CC0 Relevance: 4.6, APIs: 3, Instructions: 126COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: LongWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1378638983-0
                                                                                                                                                                                                                                                  • Opcode ID: a1e6ad4ea3411add519fa9eb8cf82d93a8a70270f0d3c039aa034d9a8afe12c1
                                                                                                                                                                                                                                                  • Instruction ID: 378f3905549dfe5e82f2af2ad3102a100031031747f5e72c637529f7e907fc09
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a1e6ad4ea3411add519fa9eb8cf82d93a8a70270f0d3c039aa034d9a8afe12c1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 17515BB6A08F8286E7548F55F8442B977A5FB88BF4F148235DA4D07B99CF3CE4648700
                                                                                                                                                                                                                                                  Function 00007FF6C647CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3251591375-0
                                                                                                                                                                                                                                                  • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                  • Instruction ID: 90ca17e13603adf4c8ff34a3d05f9d66cf65f5cfb376fac841607093474e4893
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 96318D21E5C54749FA16AF6499123B93681AF8538AF45C035D9CEC72E7DE2FB804C34C
                                                                                                                                                                                                                                                  Function 00007FF81F4660D4 Relevance: 4.6, APIs: 3, Instructions: 84windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: FocusMessageProcSendWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1049918876-0
                                                                                                                                                                                                                                                  • Opcode ID: a28c5906340cbd8dba03ecb1c669f7f3a0f2295e088e7b6a36978aab7d45cd75
                                                                                                                                                                                                                                                  • Instruction ID: c91ac58a3062c93cd42364dcac01f9d90b59f8b71fff89ad6e0bd5ce3b5065f4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a28c5906340cbd8dba03ecb1c669f7f3a0f2295e088e7b6a36978aab7d45cd75
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 133150A6A09E4285EB649F54E4902F873A1FF84BF8F140236DA4D07B95CF3DE8A5C340
                                                                                                                                                                                                                                                  Function 00007FF81F392320 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • memmove.VCRUNTIME140(?,?,00000000,?,...,00007FF81F391EA4), ref: 00007FF81F3923ED
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memmove
                                                                                                                                                                                                                                                  • String ID: ...$max size for a Tcl value (%d bytes) exceeded
                                                                                                                                                                                                                                                  • API String ID: 2162964266-3564828104
                                                                                                                                                                                                                                                  • Opcode ID: 5f34391651a3cf79b538a0bf609c6388166d1089f266b6f3b4f028dc17315685
                                                                                                                                                                                                                                                  • Instruction ID: efbe1449b4ea399f538b4aa4b5cefd66060f85e999b25931fc7f4089354412ca
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5f34391651a3cf79b538a0bf609c6388166d1089f266b6f3b4f028dc17315685
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7421AEB2709E8182EA14CF16A58023EB7A1FB447E0F544738EE6D0BB94DF3CE0518B00
                                                                                                                                                                                                                                                  Function 00007FF81F4DCCE0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 418COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: bad frame factor in ArrangePacking
                                                                                                                                                                                                                                                  • API String ID: 0-4121849145
                                                                                                                                                                                                                                                  • Opcode ID: da2c3561bdb54c3055f988eb7722a3676269eda198c2d6ddac4b2784838315ab
                                                                                                                                                                                                                                                  • Instruction ID: 22f048bc20600d98593b213bfd444b2c155dcd86cc2bc4290caa986b9dfa78b0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: da2c3561bdb54c3055f988eb7722a3676269eda198c2d6ddac4b2784838315ab
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9902DC33A18A918BC7A4CF19D184B6D77B0FB98B98F158235DF8983B54DB39E851CB40
                                                                                                                                                                                                                                                  Function 00007FF81F4732B0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • GetSystemMetrics.USER32 ref: 00007FF81F4732EA
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F446870: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF81F4468BB
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: MetricsSystem__stdio_common_vsprintf
                                                                                                                                                                                                                                                  • String ID: pathName ?-option value ...?
                                                                                                                                                                                                                                                  • API String ID: 2968932569-1831586811
                                                                                                                                                                                                                                                  • Opcode ID: 246e4a3e8c38a7b0815b22da340ce2a0966459d97e02a97ab6054007c486c478
                                                                                                                                                                                                                                                  • Instruction ID: 450fd9f6fc4e081c0a18f7416e3a1e70a40142ccc1258793df7391eb9dfb22fe
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 246e4a3e8c38a7b0815b22da340ce2a0966459d97e02a97ab6054007c486c478
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 89A102BA604B8185E7409F21F9407EA33A8F748B9CF584239DE8D4B319DF38D0A9E714
                                                                                                                                                                                                                                                  Function 00007FF81F2AC8A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: name
                                                                                                                                                                                                                                                  • API String ID: 0-1579384326
                                                                                                                                                                                                                                                  • Opcode ID: acbc8ae3b93b409195a380a283fd45be0f747e9dbb314ea4bcae243b5dce0e28
                                                                                                                                                                                                                                                  • Instruction ID: d92f4252556f24245b3da79209c41905e64bb95ab9e8ac0e09a39311bc7267a6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: acbc8ae3b93b409195a380a283fd45be0f747e9dbb314ea4bcae243b5dce0e28
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A611C671F19F4282EB589B26A91127A1791AF49FF0F945234ED1E8BBD1DE2CD4808740
                                                                                                                                                                                                                                                  Function 00007FF81F448350 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: ButtonProc called on an invalid HWND
                                                                                                                                                                                                                                                  • API String ID: 0-237202145
                                                                                                                                                                                                                                                  • Opcode ID: c30736873f5bf611dc5309c698b01d44c728c3bf6bfa2fa56b58abadda6ba518
                                                                                                                                                                                                                                                  • Instruction ID: e0d676ce3ed196327907b9827415b85a0ba82549ff7c2e5f7a87fbbc12e82222
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c30736873f5bf611dc5309c698b01d44c728c3bf6bfa2fa56b58abadda6ba518
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2C11E362B09F4586FA15DB16E8503B96360BF85BE8F484231DE4D47766EE3CE4A3C700
                                                                                                                                                                                                                                                  Function 00007FF81F4A2040 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • printf.MSPDB140-MSVCRT ref: 00007FF81F4A2084
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F4A13D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,?,?,00007FF81F4A1FFA), ref: 00007FF81F4A13F8
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F4A13D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,?,?,00007FF81F4A1FFA), ref: 00007FF81F4A1417
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: __acrt_iob_func__stdio_common_vfprintfprintf
                                                                                                                                                                                                                                                  • String ID: auto-focussing on %s, force %d
                                                                                                                                                                                                                                                  • API String ID: 115429112-1861053898
                                                                                                                                                                                                                                                  • Opcode ID: 7fd3236ad929a5872f8e7351f650ee765fb36da36fcf3ade68ec75663ae7edb1
                                                                                                                                                                                                                                                  • Instruction ID: 2f63af56d5bd296ae278840468918a5f899647cdca14925fd299ec83a0b799bb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7fd3236ad929a5872f8e7351f650ee765fb36da36fcf3ade68ec75663ae7edb1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8B014F76A18A5582DB109F16E4403AA7361FB94BE4F045131EE8F07B59CF3CD5A6C744
                                                                                                                                                                                                                                                  Function 00007FF81F339E40 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 217COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: Buffer Underflow, BUFFER_PADDING not enough
                                                                                                                                                                                                                                                  • API String ID: 0-3280121635
                                                                                                                                                                                                                                                  • Opcode ID: 2c72081082c585c650c2c2678425b413c34ec000225da04b31894e445b4152e2
                                                                                                                                                                                                                                                  • Instruction ID: 6d982e0beb3d756465eb78f446616fb69bcd972d4f620a634986ef10cb25eab7
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c72081082c585c650c2c2678425b413c34ec000225da04b31894e445b4152e2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 79819F76F04B408AEB14CF69D480AAD37B6FB447E8F148629EE4D5BB48DB38D455CB40
                                                                                                                                                                                                                                                  Function 00007FF6C648013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                                  • Instruction ID: 8e44e4a707b2fe172f9d87dd9181db9c94e8371d7a7947c40ae396bf9dd06c94
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D351FB21B2924186F7269D25940067A7681AF48FBBF08C636DDEDC37E5CF3ED8409748
                                                                                                                                                                                                                                                  Function 00007FF81F4A1AE0 Relevance: 3.1, APIs: 2, Instructions: 132windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: MessageParentSend
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 928151917-0
                                                                                                                                                                                                                                                  • Opcode ID: fe5f35dafcfc91e55ecf4d32f6d6bd7520904aae3380e885bc52b7a82bcfa1c8
                                                                                                                                                                                                                                                  • Instruction ID: 82a077d8a37d1d51cb4b3025d1456f9c70d2418991d15996d5dc4b7dbfdbe734
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fe5f35dafcfc91e55ecf4d32f6d6bd7520904aae3380e885bc52b7a82bcfa1c8
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A3514C72609B8282EA688F15E5403BAB3A1FB84BD4F148235CF9E47B95DF7CE461C704
                                                                                                                                                                                                                                                  Function 00007FF81F3545E0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 99COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • memset.VCRUNTIME140(?,00000000,?,00007FF81F354172,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF81F354645
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$ErrorLastProcessValuememset
                                                                                                                                                                                                                                                  • String ID: unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 66380181-2759121943
                                                                                                                                                                                                                                                  • Opcode ID: 83dc4e2df01fb971047b7d535adf63118cde14d30ded929811ac03f295583541
                                                                                                                                                                                                                                                  • Instruction ID: dcbb2781499d414d570deb650dd5ad66d424ecb30863c36b810614e76d757fb6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 83dc4e2df01fb971047b7d535adf63118cde14d30ded929811ac03f295583541
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 66410FB6B15A4286DB18CF19E4A466873A5FB88BE4F058231CF5D4B7A4EF38E450CB00
                                                                                                                                                                                                                                                  Function 00007FF6C648C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2976181284-0
                                                                                                                                                                                                                                                  • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                  • Instruction ID: 8bd7184a655722c118972fa73a83a0cf4fabb9b3639818245482c1ac397c128b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 33110421718A8181DA218F25A84016A7761AB89FF5F54C332EEBD87BE8CF3DD0108B44
                                                                                                                                                                                                                                                  Function 00007FF81F4DAC60 Relevance: 2.7, APIs: 2, Instructions: 206stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strchrstrncpy
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3824778938-0
                                                                                                                                                                                                                                                  • Opcode ID: 6ba011300e732b7b233a468c1468cec9e14b461cebba7a79a8b27c0b68961da2
                                                                                                                                                                                                                                                  • Instruction ID: e67d78950bd031266cd172b5150d57f1542243756c853ea82b8ec09a702c9b92
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6ba011300e732b7b233a468c1468cec9e14b461cebba7a79a8b27c0b68961da2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E5918B36B05E8687EB68CF1AD44066977A1FB98FE8B448631CE0E03796DF38D861C700
                                                                                                                                                                                                                                                  Function 00007FF81F4BA7E0 Relevance: 2.6, APIs: 2, Instructions: 82COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2221118986-0
                                                                                                                                                                                                                                                  • Opcode ID: a21565d3b1bd8f9bcab2ac970454b69758344bbb42b2eeeb318d61a694fbada9
                                                                                                                                                                                                                                                  • Instruction ID: 35a9b9e7479ab8560d48379004c8628e051e40f13e150d0fcd50cff571dd19a3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a21565d3b1bd8f9bcab2ac970454b69758344bbb42b2eeeb318d61a694fbada9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AF314F72708A8686EB20DF16E8407AA73A5FB88B94F448131DF8D47756EF3CD445CB00
                                                                                                                                                                                                                                                  Function 00007FF6C648AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • CloseHandle.KERNEL32(?,?,?,00007FF6C648A9D5,?,?,00000000,00007FF6C648AA8A), ref: 00007FF6C648ABC6
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF6C648A9D5,?,?,00000000,00007FF6C648AA8A), ref: 00007FF6C648ABD0
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 918212764-0
                                                                                                                                                                                                                                                  • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                  • Instruction ID: 750c4e76436d3da246696b18f06bbb7b28b94ec05b33cf169f69b2be51a1b70c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DA21DB11F1C74641FA529F51945437D32929F8C796F04C236DB9EC77E2CEAEE4854348
                                                                                                                                                                                                                                                  Function 00007FF6C648BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                  • Instruction ID: 039585a80c4a783fefdeff7565ffe49cf22f5925c607893a4d0fc37de88035de
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4441D7369086458BEA368F19A54017973A1EB5DB42F14C132DBCEC36E1CF6EE442CB94
                                                                                                                                                                                                                                                  Function 00007FF81F514255 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Window
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2353593579-0
                                                                                                                                                                                                                                                  • Opcode ID: 36ffd885c79dfb69fc8fa6697619711ee2d51c805fbd8cbdaa83b20644380b8c
                                                                                                                                                                                                                                                  • Instruction ID: 6f6aec40fc2afdfd5bea3d9f0cd2d8612a9b19d1f438b3c49d788c8a824fc4be
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 36ffd885c79dfb69fc8fa6697619711ee2d51c805fbd8cbdaa83b20644380b8c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 75418272A09B4281EB258F15D8407B96BA1FB96FE4F189236EE5D47798DF39E480C310
                                                                                                                                                                                                                                                  Function 00007FF6C6477F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _fread_nolock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 840049012-0
                                                                                                                                                                                                                                                  • Opcode ID: 4900000118834b7d6e4087b4962dc8428ce36fa7a7de64a54251ee196edfec95
                                                                                                                                                                                                                                                  • Instruction ID: fb533ee37e21b1144c695e1949bc59e5abbf87c245db03e20c21e03eae372d57
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4900000118834b7d6e4087b4962dc8428ce36fa7a7de64a54251ee196edfec95
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8A21D631B196914AFA529F2265043BAB641BF4ABC5F89C431EF8C87786CE7EE041C308
                                                                                                                                                                                                                                                  Function 00007FF6C648B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                                  • Instruction ID: f08d22d3ad3305e3b84d0954854f675528ddd837a01021747f581b4722b1daca
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8C318222E1860289E713AF55844137D3690AF98B92F41C137EA9DC33E2DF7EA441C799
                                                                                                                                                                                                                                                  Function 00007FF81F45CF40 Relevance: 1.6, APIs: 1, Instructions: 77COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ShowWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1268545403-0
                                                                                                                                                                                                                                                  • Opcode ID: 2a56dacb3386ef147778ecf52b70171ae3b42b012822174fb57a4fee3c21b108
                                                                                                                                                                                                                                                  • Instruction ID: 14303bfd43b6e5f89947d34fc299fe9dd8583c619c7e6408c2c96d1b2b6a2fe2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2a56dacb3386ef147778ecf52b70171ae3b42b012822174fb57a4fee3c21b108
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1312C32609A8186EB64DF15E4543AA77F0FB88B98F084235EB8E47769DF3DD455CB00
                                                                                                                                                                                                                                                  Function 00007FF81F45F200 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: HandleLoadModule$ClassCursorIconRegisterShowWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3163394910-0
                                                                                                                                                                                                                                                  • Opcode ID: 3f086d7d6162192c85f3862b1eef622d5feb99d653a8db293011f420a0d105e9
                                                                                                                                                                                                                                                  • Instruction ID: 37ed62b947889643c4969d3ea9d61034ab7cfc9dbe830d7bc84ead1686074d09
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3f086d7d6162192c85f3862b1eef622d5feb99d653a8db293011f420a0d105e9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8421A376A08A8282EB649F21D4843B927A0EB84BB4F184635DA0E47395DF6DD8E2C700
                                                                                                                                                                                                                                                  Function 00007FF81F4DBB10 Relevance: 1.6, APIs: 1, Instructions: 308COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140(?,?,?,?,00000008,00000000,000000D0,?,?,00007FF81F4DACB2), ref: 00007FF81F4DBE59
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3510742995-0
                                                                                                                                                                                                                                                  • Opcode ID: fbcb2bb6e432a4987b9f74048de9f04632af755269406f9f8a5ac9f2ffe8a8db
                                                                                                                                                                                                                                                  • Instruction ID: 703b2d32a9d64fdb02a5b440189e6ea008d8d42512351bd14da5f486d8b0e39a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fbcb2bb6e432a4987b9f74048de9f04632af755269406f9f8a5ac9f2ffe8a8db
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7FF1E6B7602F85DACB54CF19E4805ADB7B8F798B94B59822ACB4E43720DF38D595C700
                                                                                                                                                                                                                                                  Function 00007FF6C6485F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                  • Instruction ID: 6febf06e5595b38cbb26bf99f861ea7f8ead4a45622dba0bae8c63fc620b8628
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7B119621A1C64181EAA6AF11940017DB3A1BF99B89F44C433EBCCD7AB6CF7ED4408788
                                                                                                                                                                                                                                                  Function 00007FF6C6496354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                  • Instruction ID: ec7d5431a8fbbf3bb0644662fcdf6fd6d4ba7380b0ecccfb32e52d0969aa8c77
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB21A432A18A4187EB628F28D54037977A4FB84B99F14C234EB9DC7AD9DF3ED4118B04
                                                                                                                                                                                                                                                  Function 00007FF6C64803BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                                                                                                                  • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                  • Instruction ID: a2d55805150cdb3fc1d5bd9fb315edeb4c37496498ce2e92218f1c7735faca80
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C6010821A5874140E605DF525900169B691BFD9FE2F48C232DEDCD3BE6CF3ED0118344
                                                                                                                                                                                                                                                  Function 00007FF81F46B040 Relevance: 1.5, APIs: 1, Instructions: 292COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2221118986-0
                                                                                                                                                                                                                                                  • Opcode ID: 32108d93366a595e0dde9fb969241fa5500e3fe9cf9af712be67e7bddf23e9b9
                                                                                                                                                                                                                                                  • Instruction ID: c820d55e1eaae10ad402eb9567075bf9ebd2081637adeaddc56b9fb2174e4356
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 32108d93366a595e0dde9fb969241fa5500e3fe9cf9af712be67e7bddf23e9b9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C1F1EFB1A09E8686EB58CF19EC902A537A1FB857B4F548739E56DC72E4DF3CE8418700
                                                                                                                                                                                                                                                  Function 00007FF81F45F330 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ShowWindow
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1268545403-0
                                                                                                                                                                                                                                                  • Opcode ID: 8bf8888a1e7a846f504f2452cd735e6b21774eebd42e8d034fae26394ca79355
                                                                                                                                                                                                                                                  • Instruction ID: 6b5b7eeeca4fc03b27d29ce6b73bf47bb1acdccf9cab70eb360479d8cedbe84f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8bf8888a1e7a846f504f2452cd735e6b21774eebd42e8d034fae26394ca79355
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4EF06D72E09942C2FB615E59C4843BD1391DB987B5F688231D50A4E7A8DE29E8E38202
                                                                                                                                                                                                                                                  Function 00007FF6C6478E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF6C6479390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6C64745F4,00000000,00007FF6C6471985), ref: 00007FF6C64793C9
                                                                                                                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,00007FF6C6476476,?,00007FF6C647336E), ref: 00007FF6C6478EA2
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2592636585-0
                                                                                                                                                                                                                                                  • Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
                                                                                                                                                                                                                                                  • Instruction ID: 485282f906639c465a45f2597c4676e59c7679373c5a296cc89a07cc54fdc69e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B9D0CD11F3414541EB44AB677A4663562515F8DFC4F48C035EE4D47B59DC3DC0514704
                                                                                                                                                                                                                                                  Function 00007FF81F456370 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: HandleModule
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4139908857-0
                                                                                                                                                                                                                                                  • Opcode ID: ef4f0ab1aefa760ee45cab8140c8cabce6eca321cfd37ddb399a7895746e8fb9
                                                                                                                                                                                                                                                  • Instruction ID: 9a3dd7fb928ab2dc277a781731d37e34aaabeb183dae00a67fbea3f892bcfb82
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ef4f0ab1aefa760ee45cab8140c8cabce6eca321cfd37ddb399a7895746e8fb9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4FD09260E1BF0281EA8CAB756D922B422D46F08BA0B414A3DC40E46361ED2CA4E24200
                                                                                                                                                                                                                                                  Function 00007FF6C648EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,00000000,00007FF6C648B32A,?,?,?,00007FF6C6484F11,?,?,?,?,00007FF6C648A48A), ref: 00007FF6C648EBED
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                                                  • Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                  • Instruction ID: 18d28d5cd45133b4a70b6a98f46c9da0e737aba59b2121e9720756a54f9c9dcb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 68F06254F0970381FE5B9E6699516B532855F9CB42F4CC532CE8FCA3E1DD1EE4824358
                                                                                                                                                                                                                                                  Function 00007FF6C648D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32(?,?,?,00007FF6C6480C90,?,?,?,00007FF6C64822FA,?,?,?,?,?,00007FF6C6483AE9), ref: 00007FF6C648D63A
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547426739.00007FF6C6471000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6C6470000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547402433.00007FF6C6470000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547457211.00007FF6C649B000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64AE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547484170.00007FF6C64B1000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547530619.00007FF6C64B4000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff6c6470000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4292702814-0
                                                                                                                                                                                                                                                  • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                  • Instruction ID: d3f8893b494611f6e9e045cf2051a672c6d72907477d9fe5c025f5b4a650403e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4CF05E10F0A20B81FE675F7159012B932D55F8C7B6F08D732DDAED52E1DE2EA4808398

                                                                                                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                                                                                                  Function 00007FF81F2A30E0 Relevance: 30.2, APIs: 10, Strings: 7, Instructions: 414stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _errno$isdigitmemcpystrtoul
                                                                                                                                                                                                                                                  • String ID: %s called with shared object$%s must be called with definite number of bytes to append$TclAppendBytesToByteArray$bad field specifier "%s"$formatString ?arg ...?$max size for a Tcl value (%d bytes) exceeded$unable to realloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2850858509-249125436
                                                                                                                                                                                                                                                  • Opcode ID: 82e89fd174de4a787a5a39e80ac09565299bbaba939adb482008a36e35fba792
                                                                                                                                                                                                                                                  • Instruction ID: 942c6a919b5d60deec1b1ef1736bc34a5ad75fed487d7f8e0626fc7f4e104e66
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82e89fd174de4a787a5a39e80ac09565299bbaba939adb482008a36e35fba792
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4D02CB32B08F828AEB209F65E8402AC37A1FB45BE8F444635DA4D57B99DF7DE815C740
                                                                                                                                                                                                                                                  Function 00007FF81F455FB0 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 228windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Palette$ModePixelRealizeReleaseSelectmemset
                                                                                                                                                                                                                                                  • String ID: ($XGetImage Failure$XGetImage: not implemented for empty bitmap handles$XGetImage: not implemented for format != XYPixmap$XGetImage: not implemented for plane_mask != 1
                                                                                                                                                                                                                                                  • API String ID: 2805359893-309510434
                                                                                                                                                                                                                                                  • Opcode ID: f4b38e2b7c496316216f3f8e80cc98c81955683f5c505ca69771f59fe7e39331
                                                                                                                                                                                                                                                  • Instruction ID: 6a3337ad1a9863bbde9807771510720ba00389ddcc57e17f42436c31e49c57c1
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f4b38e2b7c496316216f3f8e80cc98c81955683f5c505ca69771f59fe7e39331
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 90B14FB6608F8186D7649F15F85036AB7A4FB88BE8F504235DA8E47764DF3CE459CB00
                                                                                                                                                                                                                                                  Function 00007FF81F4CFE20 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 97registryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ClassRegister$HandleModule
                                                                                                                                                                                                                                                  • String ID: $EmbeddedMenuWindowClass$Failed to register embedded menu window class$Failed to register menu window class$MenuWindowClass
                                                                                                                                                                                                                                                  • API String ID: 1731912960-3560269961
                                                                                                                                                                                                                                                  • Opcode ID: a022b8830e441842a9a8304d1e35901ee6ea373eb2ea9fa27b82487967bb60bd
                                                                                                                                                                                                                                                  • Instruction ID: df4eb3441e42ed70ed1bfce68d921c89e7f568cb21b1b7fe65b84c25e489017c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a022b8830e441842a9a8304d1e35901ee6ea373eb2ea9fa27b82487967bb60bd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A65117B1A09F4281EB149B24F8512BA37A5FF487E4F409339D58E472A5EF3CE459C340
                                                                                                                                                                                                                                                  Function 00007FF81F161880 Relevance: 13.9, APIs: 9, Instructions: 425COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3719493655-0
                                                                                                                                                                                                                                                  • Opcode ID: 0b61fa8abd9dfcdf7751d429d18c280f61a1d7a5a4373fae919a70ebd3257318
                                                                                                                                                                                                                                                  • Instruction ID: 2ee5665ba82e413b2a0767852ebc4f906efc5ea0fae1f80d7fa0039493fa11ab
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0b61fa8abd9dfcdf7751d429d18c280f61a1d7a5a4373fae919a70ebd3257318
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7F02CF72A0CE9282F7278B15F44467976A1FB85BF4F584332DA8E96794EFADE444C300
                                                                                                                                                                                                                                                  Function 00007FF81F111960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547791441.00007FF81F111000.00000020.00000001.01000000.0000002F.sdmp, Offset: 00007FF81F110000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547767884.00007FF81F110000.00000002.00000001.01000000.0000002F.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547814488.00007FF81F116000.00000002.00000001.01000000.0000002F.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547838823.00007FF81F11B000.00000002.00000001.01000000.0000002F.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f110000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 313767242-0
                                                                                                                                                                                                                                                  • Opcode ID: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
                                                                                                                                                                                                                                                  • Instruction ID: 75fa21737a48159499e87c9bb5060399fc43d5fa49a3af0986dad5e35c6cc24d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BB314C72609F818AFB618F70E8503ED7364FB84798F44453AEA4E57A98DF39D648C710
                                                                                                                                                                                                                                                  Function 00007FF81F131960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548001606.00007FF81F131000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF81F130000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547978034.00007FF81F130000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548024322.00007FF81F133000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548046739.00007FF81F135000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f130000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 313767242-0
                                                                                                                                                                                                                                                  • Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                                  • Instruction ID: 51d8cd39cfd6efa3ad022dcd4e85025a287ecafe0f8d180fffb7ad4d512da1e9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 21313C76A08E8189FB618F60E8503E97374FB847A5F44413ADA4D57B98DF3CD688C714
                                                                                                                                                                                                                                                  Function 00007FF81F141960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548093920.00007FF81F141000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FF81F140000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548070459.00007FF81F140000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548117590.00007FF81F143000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548143747.00007FF81F145000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f140000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 313767242-0
                                                                                                                                                                                                                                                  • Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                                  • Instruction ID: 697ccb9c13a00b5b521f9441a2ba5c588b3d0983c7b718b34b178ab619f720e2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 50313972608F81CAFB628F60E8503E97364FB84798F44463ADA4E57A98DF39D648C710
                                                                                                                                                                                                                                                  Function 00007FF81F121960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547884461.00007FF81F121000.00000020.00000001.01000000.0000002E.sdmp, Offset: 00007FF81F120000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547861822.00007FF81F120000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547909020.00007FF81F124000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547932644.00007FF81F125000.00000004.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547955306.00007FF81F126000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f120000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 313767242-0
                                                                                                                                                                                                                                                  • Opcode ID: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
                                                                                                                                                                                                                                                  • Instruction ID: 78068b96c6302f4afb7c9dba61910ce150e2efa330aed82e87521165bd0f8f34
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 29315A76608E818AFB61CFA0E8507E97370FB84798F54413ADA4E57A89EF38D648C704
                                                                                                                                                                                                                                                  Function 00007FF81F163028 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 313767242-0
                                                                                                                                                                                                                                                  • Opcode ID: 077b0f214cb87451efc13930c849abf149ec882450af492fe5d50a1ac414abff
                                                                                                                                                                                                                                                  • Instruction ID: 8ec870ef05896aff925c887bf7479a061acd19206e68954a7f6e6eca836aa468
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 077b0f214cb87451efc13930c849abf149ec882450af492fe5d50a1ac414abff
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC311A72609F818AEB628F60F8503E97364FB847A4F44413ADA4E47B99DF79D548C710
                                                                                                                                                                                                                                                  Function 00007FF81F1612F0 Relevance: 10.8, APIs: 7, Instructions: 343COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 4139299733-0
                                                                                                                                                                                                                                                  • Opcode ID: bb7a1583b311f9023fc161d2ea2417430d383a05e2e7d543d3dd2600494f88aa
                                                                                                                                                                                                                                                  • Instruction ID: 692ae888564b0c1815040b47482834e5641ce1b692769017f0bfcd37369d25aa
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bb7a1583b311f9023fc161d2ea2417430d383a05e2e7d543d3dd2600494f88aa
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61E18772E0CA5281FB278B15B414ABD72A5EB65BF4F540336DA4F92794DFACE841CB00
                                                                                                                                                                                                                                                  Function 00007FF81F348060 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 179COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _errno$Value
                                                                                                                                                                                                                                                  • String ID: unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 107400726-2759121943
                                                                                                                                                                                                                                                  • Opcode ID: ccd89003533a37c923193f2408ddf49dfbc8a363624388c50f7211f6e8d1b269
                                                                                                                                                                                                                                                  • Instruction ID: 5ea0bd9ecc0246a5b8641947eac07665ea0aef0775167626c30802928fd1a95b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ccd89003533a37c923193f2408ddf49dfbc8a363624388c50f7211f6e8d1b269
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FA718C61B09F4681FBA4EB61E4503B963A0AF98BE4F444635DE4E4B796EF3CE491C700
                                                                                                                                                                                                                                                  Function 00007FF81F299050 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 440COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                                                  • String ID: ::pkgconfig$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3510742995-2541110879
                                                                                                                                                                                                                                                  • Opcode ID: ef4e5913774b350ba506974e8de304e85108a833bf779ef9fbe52681919b976d
                                                                                                                                                                                                                                                  • Instruction ID: 7c37cc04af9f92fadedce158f0e5dc1463879d5879515553764eb6cba2d35250
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ef4e5913774b350ba506974e8de304e85108a833bf779ef9fbe52681919b976d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4302AE72B09B9686EB249F26E48036A73A0FB84BE4F184235DE4E47799DF3CE451C740
                                                                                                                                                                                                                                                  Function 00007FF81F122EB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547884461.00007FF81F121000.00000020.00000001.01000000.0000002E.sdmp, Offset: 00007FF81F120000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547861822.00007FF81F120000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547909020.00007FF81F124000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547932644.00007FF81F125000.00000004.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547955306.00007FF81F126000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f120000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _wassert
                                                                                                                                                                                                                                                  • String ID: OCB_ENCRYPT==direction || OCB_DECRYPT==direction$src/raw_ocb.c
                                                                                                                                                                                                                                                  • API String ID: 3234217646-1106498308
                                                                                                                                                                                                                                                  • Opcode ID: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
                                                                                                                                                                                                                                                  • Instruction ID: 58523ecbbf4525f9510bf31474acb1080eb61698a818678323179668567f9dbf
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A9E1294210D6D008D7168FB590206BE7FB0DB1FA59F4D41B6EBE94E58BD608C244EB2A
                                                                                                                                                                                                                                                  Function 00007FF81F4E40B0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 223COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E40D6
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E40E4
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4101
                                                                                                                                                                                                                                                  • log10.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4107
                                                                                                                                                                                                                                                  • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E410D
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E415C
                                                                                                                                                                                                                                                  • log10.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4162
                                                                                                                                                                                                                                                  • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4168
                                                                                                                                                                                                                                                  • pow.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4186
                                                                                                                                                                                                                                                  • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E41AA
                                                                                                                                                                                                                                                  • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E41D1
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4208
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4219
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E423E
                                                                                                                                                                                                                                                  • pow.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF81F4E425D
                                                                                                                                                                                                                                                  • floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF81F4E4278
                                                                                                                                                                                                                                                  • floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF81F4E429F
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF81F4E42D6
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF81F4E42E7
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF81F4E4303
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4363
                                                                                                                                                                                                                                                  • fabs.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4382
                                                                                                                                                                                                                                                  • log10.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E4388
                                                                                                                                                                                                                                                  • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF81F4E3542), ref: 00007FF81F4E438E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: fabs$floor$log10
                                                                                                                                                                                                                                                  • String ID: %%.%de$%%.%df
                                                                                                                                                                                                                                                  • API String ID: 2163138323-2067013384
                                                                                                                                                                                                                                                  • Opcode ID: c7f216134bb94a1ffa50d0aaff1a80a3957c375bb820970b2c3ae2f02829f805
                                                                                                                                                                                                                                                  • Instruction ID: d2a88adee930f03fdfff7444028ed57202a63e4e60f1674507564aebc7f60b30
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c7f216134bb94a1ffa50d0aaff1a80a3957c375bb820970b2c3ae2f02829f805
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A8A1C822E18E4589E3179B3C94016B9F3A5FF66BE5F058332E54A72135EF2DA8D3C600
                                                                                                                                                                                                                                                  Function 00007FF81F323760 Relevance: 42.4, APIs: 8, Strings: 16, Instructions: 370COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F323775
                                                                                                                                                                                                                                                  • _isnan.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F323787
                                                                                                                                                                                                                                                  • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F323795
                                                                                                                                                                                                                                                  • _finite.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F3237A3
                                                                                                                                                                                                                                                  • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F3237AD
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _errno$_finite_isnan
                                                                                                                                                                                                                                                  • String ID: )$?-option value ...? source ?source ...? target$ARITH$DOMAIN$OVERFLOW$POSIX$UNDERFLOW$UNKNOWN$copying$domain error: argument not in valid range$error %s: target "%s" is not a directory$floating-point value too large to represent$floating-point value too small to represent$renaming$unable to alloc %u bytes$unknown floating-point error, errno = %d
                                                                                                                                                                                                                                                  • API String ID: 3696783373-1871482965
                                                                                                                                                                                                                                                  • Opcode ID: 5eff94ccb39fcc0e97b26804f3478770b2b6ca305fcd1893234d714ceab1af84
                                                                                                                                                                                                                                                  • Instruction ID: d32ae08cb370905a2aac0209f90c9036d75000789f2969632138827efecd0daf
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5eff94ccb39fcc0e97b26804f3478770b2b6ca305fcd1893234d714ceab1af84
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7BF17B62A09E8686EB54AF25E8402BD73A1FF84BE4F444335EE4E4B796DF3CE4458740
                                                                                                                                                                                                                                                  Function 00007FF81F44BF60 Relevance: 42.4, APIs: 13, Strings: 11, Instructions: 351stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentDirectorymemset$Path$BrowseEnableFolderFromFullListMallocNameWindowstrcmpwcsncpy
                                                                                                                                                                                                                                                  • String ID: -xpstyle$::tk::winChooseDirFlags$DIRDIALOG$FILEDIALOG$PSEUDO$Please choose a directory, then select OK.$VALUE$error: not a file system folder$option$value for "%s" missing$value for "-xpstyle" missing
                                                                                                                                                                                                                                                  • API String ID: 1517725768-2564141266
                                                                                                                                                                                                                                                  • Opcode ID: 10c83d3983d9f5d6424bbb9c6adce500a6b93dc3d3388855b69038c2e9d76582
                                                                                                                                                                                                                                                  • Instruction ID: 5699ac15fdb96cedd2117c572ac51aafb2eeb6a73c8b8639c119ba989f6f3f18
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 10c83d3983d9f5d6424bbb9c6adce500a6b93dc3d3388855b69038c2e9d76582
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 30024A76A08F8686EB249F25DC542F933A5FB88BE9F444232CA4E577A9DF38D145C700
                                                                                                                                                                                                                                                  Function 00007FF81F2A10B0 Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 438memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • TlsAlloc.KERNEL32 ref: 00007FF81F2A1113
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32 ref: 00007FF81F2A113C
                                                                                                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00007FF81F2A114A
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32 ref: 00007FF81F2A11EB
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32 ref: 00007FF81F2A11FE
                                                                                                                                                                                                                                                  • HeapAlloc.KERNEL32 ref: 00007FF81F2A120F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A028D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02BB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02C9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A036B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A037E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A038F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$CriticalErrorLastLeaveProcessSectionValue
                                                                                                                                                                                                                                                  • String ID: ?returnValue?$Adding a callback without an objProc?!$COROUTINE$ILLEGAL_YIELD$TCL$TlsGetValue failed from TclpGetAllocCache$YIELDTO_IN_DELETED$alloc: could not allocate %d new objects$command ?arg ...?$could not allocate thread local storage$routine$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3042485339-3667751179
                                                                                                                                                                                                                                                  • Opcode ID: 0c801d82a998583f4012e03c06fe4a0ea672e9b0490f9b8d3da85b6b12ea7047
                                                                                                                                                                                                                                                  • Instruction ID: 16eb7ec7482f931c1157c1d415e27f1e9f3a4a9a00b9b1cdf5e73aa483e5b4ec
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0c801d82a998583f4012e03c06fe4a0ea672e9b0490f9b8d3da85b6b12ea7047
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C5229C76A09F4186EB14CF29E8401A933A0FB58BE4F244336DA4D4BB66DF3DE491C740
                                                                                                                                                                                                                                                  Function 00007FF81F461E10 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 311windowstringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Icon$Destroy$FileInfo$CreateIndirectmemsetstrcmp
                                                                                                                                                                                                                                                  • String ID: -default$H$ICONBITMAP$OPTION$Tk_SizeOfBitmap received unknown bitmap argument$illegal option "%s" must be "-default"$window ?-default? ?image?
                                                                                                                                                                                                                                                  • API String ID: 1970194709-3871694194
                                                                                                                                                                                                                                                  • Opcode ID: e25985d23da4d5311c65bb1bbb579826646a8fa551ffc8da1199a6a75bc92467
                                                                                                                                                                                                                                                  • Instruction ID: 1c151e9f2e3aaaf62009b3d0ee9037967c53e3f3a8d5c3a12a8eeb6d5f6e0243
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e25985d23da4d5311c65bb1bbb579826646a8fa551ffc8da1199a6a75bc92467
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9AE13876609F8282EA589F12E8542B973A5FB88FE4F084235DE8E47765EF3CE455C700
                                                                                                                                                                                                                                                  Function 00007FF81F3D3F40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 135registrythreadCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalSection$ClassCreateCurrentEventInitializeLeaveRegisterThreadValue
                                                                                                                                                                                                                                                  • String ID: TclNotifier$Unable to register TclNotifier window class$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 1341508405-959679639
                                                                                                                                                                                                                                                  • Opcode ID: c567e152e65794d02d65d4dcac0a640c1f4207665154df2e55240a551168aa8e
                                                                                                                                                                                                                                                  • Instruction ID: d7ae94c8e8978ae5e6ad4d1c0d30a636fda3a49f4f0153ca6dbf0f858c02abf8
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c567e152e65794d02d65d4dcac0a640c1f4207665154df2e55240a551168aa8e
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 34514826E19F4282EB509F15E89027967A4FF98BE4F444336DA4E4B765EF3CE494CB00
                                                                                                                                                                                                                                                  Function 00007FF81F45DF00 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 374COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: -encoding$-translation$Error converting to internal format$FORMAT$ICON$Invalid file header$READ$binary$error opening file "%s" for reading: %s$error reading file: %s$error seeking in file: %s
                                                                                                                                                                                                                                                  • API String ID: 0-1482656021
                                                                                                                                                                                                                                                  • Opcode ID: 1d3be55ff07dc83df80faf6eef418b5ef0f003445f5813d67b438c9e71c2744b
                                                                                                                                                                                                                                                  • Instruction ID: f7d612ed721f97cdd2a4150ea663f03b8873337e1a99bb8b05d4c6aca6c9aa1d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1d3be55ff07dc83df80faf6eef418b5ef0f003445f5813d67b438c9e71c2744b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 59F15CB6608E42C6EA648F16E8545B837A9FB88FE1F459276CE8E43765DF3CE444C700
                                                                                                                                                                                                                                                  Function 00007FF81F2AB860 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 249COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3ABC30: memcpy.VCRUNTIME140(?,?,?,?,FFFFFFFF,?,?,?,?,?,?,?,?,?,?,00007FF81F3A0608), ref: 00007FF81F3ABCA9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3ABC30: memcpy.VCRUNTIME140(?,?,EF0341C630438948,00007FF81F3A0608), ref: 00007FF81F3ABCF2
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F2AB969
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F2ABA09
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy$AllocHeap$ErrorLastProcessValue
                                                                                                                                                                                                                                                  • String ID: ::tcl::file::$SAFE$SUBCOMMAND$TCL$___tmp$file$not allowed to invoke subcommand %s of file$problem making 'file %s' safe: %s$problem making 'file' safe: %s$tcl:file:$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2673728140-2984438679
                                                                                                                                                                                                                                                  • Opcode ID: 1f130709ed6216e380ccd19bed4ab9b50c5c64dc1a483466435b0b226b91d440
                                                                                                                                                                                                                                                  • Instruction ID: 2939fc2a38c26e4d6a327dddc9238d934cf37c72597de20c13c1787d60027a49
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1f130709ed6216e380ccd19bed4ab9b50c5c64dc1a483466435b0b226b91d440
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CCB1A762A19F8286EB10DF11D4902EA7350FF447E8F444A36EA4E4BB9AEF7CE505C740
                                                                                                                                                                                                                                                  Function 00007FF81F2AA8F0 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 249COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3ABC30: memcpy.VCRUNTIME140(?,?,?,?,FFFFFFFF,?,?,?,?,?,?,?,?,?,?,00007FF81F3A0608), ref: 00007FF81F3ABCA9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3ABC30: memcpy.VCRUNTIME140(?,?,EF0341C630438948,00007FF81F3A0608), ref: 00007FF81F3ABCF2
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F2AA9F9
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F2AAA99
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy$AllocHeap$ErrorLastProcessValue
                                                                                                                                                                                                                                                  • String ID: ::tcl::encoding::$SAFE$SUBCOMMAND$TCL$___tmp$encoding$not allowed to invoke subcommand %s of encoding$problem making 'encoding %s' safe: %s$problem making 'encoding' safe: %s$tcl:encoding:$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2673728140-1154417245
                                                                                                                                                                                                                                                  • Opcode ID: 6187d0e8425b4ddcbdcd0dbccd55b5638864cff5095b29f768cb2456465ea46f
                                                                                                                                                                                                                                                  • Instruction ID: 16e3d52910300dbfd815346aa6d4ff0c33b30b9f84f362837042f65b0b5d57cc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6187d0e8425b4ddcbdcd0dbccd55b5638864cff5095b29f768cb2456465ea46f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F8B1A762A19F4286EB14DF11D4902E963A1FF547E4F444A36EA4E4BB9AEF3CE405CB40
                                                                                                                                                                                                                                                  Function 00007FF81F164910 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CompareUnicode_$DeallocStringWith
                                                                                                                                                                                                                                                  • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                                                  • API String ID: 1004266020-3528878251
                                                                                                                                                                                                                                                  • Opcode ID: 1585b7f006c3bc3ef317b73109392006e48ef7fb1c9bb5363a1940f6ac4bfac5
                                                                                                                                                                                                                                                  • Instruction ID: ca997b1e195923ddc196cc7ac6e68a4f2b9ecf730d1518c13b1273b336965eae
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1585b7f006c3bc3ef317b73109392006e48ef7fb1c9bb5363a1940f6ac4bfac5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 87415D22A48E1292FA179B15B86027973A2BF89BF4F944235CD8E87754DFBDE0449300
                                                                                                                                                                                                                                                  Function 00007FF81F1624B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Module_$DeallocObjectObject_$ConstantFromSpecStringTrackTypeType_
                                                                                                                                                                                                                                                  • String ID: 15.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
                                                                                                                                                                                                                                                  • API String ID: 2663085338-4141011787
                                                                                                                                                                                                                                                  • Opcode ID: 35f2a36de3bf8fc04aa01d781381661ddda8c4355416510f682401fb826b2ab5
                                                                                                                                                                                                                                                  • Instruction ID: 65aa9019fa461badfd712e6c69c4b3c21eaa3236fd89f24941aabaa38e0243f6
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 35f2a36de3bf8fc04aa01d781381661ddda8c4355416510f682401fb826b2ab5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE310E21E0DE9381FA275F25B8242F932A1AF89BF0F955330DD0D46699DFECE4448701
                                                                                                                                                                                                                                                  Function 00007FF81F1611B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
                                                                                                                                                                                                                                                  • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                                                                  • API String ID: 1723213316-3528878251
                                                                                                                                                                                                                                                  • Opcode ID: 0183ee75f38b3d9b4e000f242270cd4c61522a137d2eba0fb5a9939ca12be486
                                                                                                                                                                                                                                                  • Instruction ID: 3cf7ae5ff0897a7c5cdf1fda97aff0bbc5aacf55806a7c40aa96c27929784e9b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 0183ee75f38b3d9b4e000f242270cd4c61522a137d2eba0fb5a9939ca12be486
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A518D61E0CE4282FB638B16B5606793290AF56FF8F245339DD4E97A85DFACE4018700
                                                                                                                                                                                                                                                  Function 00007FF81F1644E4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                                                                                                                                  • String ID: $%04X$a unicode character$argument$decomposition
                                                                                                                                                                                                                                                  • API String ID: 1318908108-4056541097
                                                                                                                                                                                                                                                  • Opcode ID: 2aa5bcb769f9567ef44792d0b8645ff4acf96607a2464068c30a17cc2bf935c6
                                                                                                                                                                                                                                                  • Instruction ID: 8e89af2c91c707e3eb322b1cd8bf2eafdddeb583aafda61608c1592aca09286c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2aa5bcb769f9567ef44792d0b8645ff4acf96607a2464068c30a17cc2bf935c6
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 514191A2A08E8292FA278B15F8142B933A2FF99BF4F444335D95E476D4DF6CE545C700
                                                                                                                                                                                                                                                  Function 00007FF81F111030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547791441.00007FF81F111000.00000020.00000001.01000000.0000002F.sdmp, Offset: 00007FF81F110000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547767884.00007FF81F110000.00000002.00000001.01000000.0000002F.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547814488.00007FF81F116000.00000002.00000001.01000000.0000002F.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547838823.00007FF81F11B000.00000002.00000001.01000000.0000002F.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f110000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 349153199-0
                                                                                                                                                                                                                                                  • Opcode ID: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
                                                                                                                                                                                                                                                  • Instruction ID: a22ba0ddb2dda3b29fdaa7544cea22ee33858211d44b93a317796d95431b17f2
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B581DE61E1CE4386FA52AB7694412B9E2A8BF857F0F544735FA0CA3796DF3DE4028700
                                                                                                                                                                                                                                                  Function 00007FF81F131030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548001606.00007FF81F131000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF81F130000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547978034.00007FF81F130000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548024322.00007FF81F133000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548046739.00007FF81F135000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f130000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 349153199-0
                                                                                                                                                                                                                                                  • Opcode ID: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                                  • Instruction ID: 921dea2e32b5461ab64e9c186ebabcbe0bf719d1ae81fe16f475173d0ddb8404
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D481AF61E0CE4386FB53AB6694412B962B0AF857F0F548735D94DA3796DF3CE4C68700
                                                                                                                                                                                                                                                  Function 00007FF81F141030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548093920.00007FF81F141000.00000020.00000001.01000000.0000002C.sdmp, Offset: 00007FF81F140000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548070459.00007FF81F140000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548117590.00007FF81F143000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548143747.00007FF81F145000.00000002.00000001.01000000.0000002C.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f140000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 349153199-0
                                                                                                                                                                                                                                                  • Opcode ID: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                                  • Instruction ID: d831d69248b7e632362ccd84b1e98ca31e819a13762078f12bcfa96a7a562162
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 65819C61F0CE47C6FA53AB66A4412B92291AFD5BF0F548735D90DA7796DF3CE8028B00
                                                                                                                                                                                                                                                  Function 00007FF81F121030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2547884461.00007FF81F121000.00000020.00000001.01000000.0000002E.sdmp, Offset: 00007FF81F120000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547861822.00007FF81F120000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547909020.00007FF81F124000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547932644.00007FF81F125000.00000004.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2547955306.00007FF81F126000.00000002.00000001.01000000.0000002E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f120000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 349153199-0
                                                                                                                                                                                                                                                  • Opcode ID: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
                                                                                                                                                                                                                                                  • Instruction ID: 4bbc05dda726ad50d1144694655325a4884742ddb0296228be36550bcf1c9799
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E5819D29E08E4746FB56DBE5A4412B922A1BF957E0F744335E90DA3796FF3CE4028600
                                                                                                                                                                                                                                                  Function 00007FF81F2A0870 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 168memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$CriticalErrorLastLeaveProcessSectionValue
                                                                                                                                                                                                                                                  • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: could not allocate %d new objects$could not allocate thread local storage
                                                                                                                                                                                                                                                  • API String ID: 3042485339-3925149219
                                                                                                                                                                                                                                                  • Opcode ID: 53d360f67be7209356c73850bda78dca7c019947cb673d109d8102c85bece13c
                                                                                                                                                                                                                                                  • Instruction ID: c19b78bb7cb89c8c120e7825224349ea21c1569d7fa176565fe542712f512adc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 53d360f67be7209356c73850bda78dca7c019947cb673d109d8102c85bece13c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A48149B6A05F06C6EB54CF29E48026833A4FB58BE4F140236CA4D8B751EF3CD5A5C780
                                                                                                                                                                                                                                                  Function 00007FF81F1646A8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 62COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckDigitErr_FromLongLong_PositionalStringUnicode_
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$digit$not a digit
                                                                                                                                                                                                                                                  • API String ID: 4245020737-4278345224
                                                                                                                                                                                                                                                  • Opcode ID: d2c025be6f32e1fa96eb3f1c6703f3e18d3fbf46a97c983d3ea169cd79d16b21
                                                                                                                                                                                                                                                  • Instruction ID: ec52068318ac8b37d0d9c186f7e38867f6438e282c89ce5e139c90eeff22650e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d2c025be6f32e1fa96eb3f1c6703f3e18d3fbf46a97c983d3ea169cd79d16b21
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 56215A35A08E42C5FA138B15F44027933A6FB95BF8F955236C90E87B68DFADE445C300
                                                                                                                                                                                                                                                  Function 00007FF81F162720 Relevance: 15.2, APIs: 10, Instructions: 227COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 190073905-0
                                                                                                                                                                                                                                                  • Opcode ID: bc53fe8a0eda1481b36a314380ac74b5aff62c5ee69524d86cd6bd6c99e3d1c0
                                                                                                                                                                                                                                                  • Instruction ID: 4099b9dd90be726023ba1dfffd59a68e53de4e80e6014fbf549ec4ded18cd803
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bc53fe8a0eda1481b36a314380ac74b5aff62c5ee69524d86cd6bd6c99e3d1c0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E81CF21E08E8385FE679B66B8512F93291AF967F0F548339D90C53792DFBCE8058700
                                                                                                                                                                                                                                                  Function 00007FF81F3B08A0 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 202COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: Cannot trace a variable with no name$READ$TCL$VARNAME$WRITE$part1Ptr must not be NULL$unable to alloc %u bytes$user$varPtr must not be NULL
                                                                                                                                                                                                                                                  • API String ID: 0-2986239259
                                                                                                                                                                                                                                                  • Opcode ID: 1f0de03ea7fde6e3ac442b81db6947e18dcdceba1f872faded4bbbb72bbaff7f
                                                                                                                                                                                                                                                  • Instruction ID: 813ef4114e35d90dad01ea32c5934ff1f429375767d8776a785e3a482fd76e25
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1f0de03ea7fde6e3ac442b81db6947e18dcdceba1f872faded4bbbb72bbaff7f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 077181B2A08B8586EA64DF16E85036AB7A4FB88BE4F144635DF8D4BB55DF3CE450C700
                                                                                                                                                                                                                                                  Function 00007FF81F28A030 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 241COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: fprintf$__stdio_common_vfprintf
                                                                                                                                                                                                                                                  • String ID: constraints:$empties:$final cleanup:$initial cleanup:
                                                                                                                                                                                                                                                  • API String ID: 1660322318-4175063448
                                                                                                                                                                                                                                                  • Opcode ID: dd5fcfafd3b868d1bf4f364564f9a40b97697f97398ab3eda6ece9fef3441ae1
                                                                                                                                                                                                                                                  • Instruction ID: 08a2f038e4a463e12cd255f12e3190b96202ed410dd011755eebc1a7e41e041c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dd5fcfafd3b868d1bf4f364564f9a40b97697f97398ab3eda6ece9fef3441ae1
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D3A16826A09F4296EE64DA06D04437A67E1FB44FE4F598631DE4D0B799DF3DE880CB40
                                                                                                                                                                                                                                                  Function 00007FF81F469FAB Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 136stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmpstrtol
                                                                                                                                                                                                                                                  • String ID: "%s" option requires an additional argument$ARG$INTEGER$MISSING$expected %s argument for "%s" but got "%s"$integer
                                                                                                                                                                                                                                                  • API String ID: 826613874-1598512142
                                                                                                                                                                                                                                                  • Opcode ID: b3ad5ceb6f2eb501605b98779fa210828681e0c8b282bd6f9da46d1ab53b2909
                                                                                                                                                                                                                                                  • Instruction ID: acdb4446188255287e31b5b0b728762a1940f300c1c9a4b5be597e555ffc2423
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b3ad5ceb6f2eb501605b98779fa210828681e0c8b282bd6f9da46d1ab53b2909
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 96515C66A08E8685EB658B06E8403B977A5FB85BF4F054232DE8E43798DF3CE455C740
                                                                                                                                                                                                                                                  Function 00007FF81F46A059 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 135stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmpstrtod
                                                                                                                                                                                                                                                  • String ID: "%s" option requires an additional argument$ARG$FLOAT$MISSING$expected %s argument for "%s" but got "%s"$floating-point
                                                                                                                                                                                                                                                  • API String ID: 1067362368-3606263203
                                                                                                                                                                                                                                                  • Opcode ID: e1826304d8cd0dc696530cb59c8d60975446d8b9f8c7729ea9acfb31f092940c
                                                                                                                                                                                                                                                  • Instruction ID: fd09dc954fe71292980cef9559568402663d86cc013ca6675c1b3f16691c129a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e1826304d8cd0dc696530cb59c8d60975446d8b9f8c7729ea9acfb31f092940c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 40516D66A08E8685EB658B05F8403B977A5FB85BF4F044232DE8E437A8DF3CE455C740
                                                                                                                                                                                                                                                  Function 00007FF81F517E30 Relevance: 13.8, APIs: 1, Strings: 8, Instructions: 321COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: MISSING$Missing value for "%s".$REQUIRED$TTK$Ttk$VSAPI$missing required arguments 'class' and/or 'partId'$option
                                                                                                                                                                                                                                                  • API String ID: 0-1444459223
                                                                                                                                                                                                                                                  • Opcode ID: 28b5e4a1d1c7a925a9917ab9ce786b4f8d0f34081dec90b72739fd5668c3f888
                                                                                                                                                                                                                                                  • Instruction ID: e3d61b1faf941a9468878f35ab779098cfa7789eaa8654d9e1a45d8e7a0bba5c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 28b5e4a1d1c7a925a9917ab9ce786b4f8d0f34081dec90b72739fd5668c3f888
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 09F13A76A08F82C6DB14CF16E8502AA77B5FB48BE8F444235DA8D47769DF38D549C700
                                                                                                                                                                                                                                                  Function 00007FF81F4ABE60 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 188COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Cursor$Capture
                                                                                                                                                                                                                                                  • String ID: GRAB$GRABBED$grab failed: another application has grab
                                                                                                                                                                                                                                                  • API String ID: 3198408678-3878467564
                                                                                                                                                                                                                                                  • Opcode ID: dad5115b9e30cd38ee97b81aa9e27861ca0ac6e0cf43807c9d02d0dc7028662a
                                                                                                                                                                                                                                                  • Instruction ID: 4f08ea9b9d0196733a114fdcd96fa3ffde5b869e41ff8da3fd999f347364339b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dad5115b9e30cd38ee97b81aa9e27861ca0ac6e0cf43807c9d02d0dc7028662a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 06913A76609E8286EB64CF25E8402B977A4FB88BE4F044235DE8E47755DF3CE465CB04
                                                                                                                                                                                                                                                  Function 00007FF81F46C030 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 175COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: isprint
                                                                                                                                                                                                                                                  • String ID: %s-$-%u$<<%s>>$Double-$Quadruple-$Triple-
                                                                                                                                                                                                                                                  • API String ID: 3707773532-11434533
                                                                                                                                                                                                                                                  • Opcode ID: c0e08eedeb8e068c1fd20f1d63954dd6b8224c5fdabeeb564ef7255839b6278d
                                                                                                                                                                                                                                                  • Instruction ID: b8e5065d173dd540a4398b167ebfafcd77216058518ab2c4a4e12a8b288055e0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c0e08eedeb8e068c1fd20f1d63954dd6b8224c5fdabeeb564ef7255839b6278d
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FC817676E08E8286EA248B1AF8542B977A1FB45BF5F488232CE4E07765CF3CE454C700
                                                                                                                                                                                                                                                  Function 00007FF81F3DFF10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 105memoryCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00007FF81F39FD4E,?,?,?,00007FF81F3A047E), ref: 00007FF81F3DFFB5
                                                                                                                                                                                                                                                  • GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,00007FF81F39FD4E,?,?,?,00007FF81F3A047E), ref: 00007FF81F3DFFBB
                                                                                                                                                                                                                                                  • HeapFree.KERNEL32(?,?,?,?,?,?,?,?,00007FF81F39FD4E,?,?,?,00007FF81F3A047E), ref: 00007FF81F3DFFC9
                                                                                                                                                                                                                                                  • TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF81F39FD4E,?,?,?,00007FF81F3A047E), ref: 00007FF81F3DFFD7
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0720: LeaveCriticalSection.KERNEL32(?,?,00007FF81F39FEFB,0000000A,00000000,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A07F1
                                                                                                                                                                                                                                                  • TlsFree.KERNEL32(?,?,?,?,?,?,?,?,00007FF81F39FD4E,?,?,?,00007FF81F3A047E), ref: 00007FF81F3DFFF2
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CriticalFreeHeapLeaveSection$ProcessValue
                                                                                                                                                                                                                                                  • String ID: TlsFree failed from TclpFreeAllocCache$TlsSetValue failed from TclpFreeAllocCache
                                                                                                                                                                                                                                                  • API String ID: 3646568635-656207173
                                                                                                                                                                                                                                                  • Opcode ID: dd1aa1e0027434841db8347f0dcca98164ef02551451e3163858b814c96b5edb
                                                                                                                                                                                                                                                  • Instruction ID: 3ab543398c4279f415e34d1bd58ce4fecd320fc0e68b2f27ad11821685d7a145
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: dd1aa1e0027434841db8347f0dcca98164ef02551451e3163858b814c96b5edb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3041AE65F19E0782EF44DB26E9906796361FF84BE0F444231EA0E4B7A5DE3CE856CB00
                                                                                                                                                                                                                                                  Function 00007FF81F449FED Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 112stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strcmp
                                                                                                                                                                                                                                                  • String ID: -xpstyle$LOOKUP$NO_MAIN_WINDOW$NULL main window$WINDOW$bad window path name "%s"$option
                                                                                                                                                                                                                                                  • API String ID: 1004003707-853872699
                                                                                                                                                                                                                                                  • Opcode ID: f68739bc49b372af0123cddd5d110f9f0d0c18da064812332e661aa23b62c7ce
                                                                                                                                                                                                                                                  • Instruction ID: 6b041e9a97672848ac08281730dc2f59768d12c3e9f2b377ab3ecb61536ae0bb
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f68739bc49b372af0123cddd5d110f9f0d0c18da064812332e661aa23b62c7ce
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EB515876A09F86C1EB148F16E8542BA63A5FB88BE4F458232CE4E177A5DF3CE055D700
                                                                                                                                                                                                                                                  Function 00007FF81F294810 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 312COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • memset.VCRUNTIME140(?,?,?,?,?,00000000,?,?,00000000,?,?,00007FF81F2936EB), ref: 00007FF81F294903
                                                                                                                                                                                                                                                  • memset.VCRUNTIME140(?,?,?,?,?,00000000,?,?,00000000,?,?,00007FF81F2936EB), ref: 00007FF81F29491E
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memset
                                                                                                                                                                                                                                                  • String ID: UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$unable to alloc %u bytes$unclosed catch at end of code in tclAssembly.c:BuildExceptionRanges, can't happen$undefined label in tclAssembly.c:BuildExceptionRanges, can't happen
                                                                                                                                                                                                                                                  • API String ID: 2221118986-1743407648
                                                                                                                                                                                                                                                  • Opcode ID: 3bf4c1f8c6f5722804c9889e5201c56968af07b26723e8b4eeeb48b408e7f59c
                                                                                                                                                                                                                                                  • Instruction ID: 2ae8f53e695eccefec891e5fc3a94fd01dcf0a6a335a8472770fc84f668288ea
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3bf4c1f8c6f5722804c9889e5201c56968af07b26723e8b4eeeb48b408e7f59c
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B7D1DBB2A09E9286EB54CF18D5906AD73A1FB94BE4F058336CB5C47395EF38E855C300
                                                                                                                                                                                                                                                  Function 00007FF81F4B6020 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 291COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: GIF$IMAGE$MALFORMED$error reading GIF image: %s$malformed image
                                                                                                                                                                                                                                                  • API String ID: 0-4136127321
                                                                                                                                                                                                                                                  • Opcode ID: fedb1562ed183d033e759b5e36068e204e2b6058cb4f0b41f5984ba8c23f28b5
                                                                                                                                                                                                                                                  • Instruction ID: ff80ba6d6c866617661100cbaec9ea8ea51dbbee8407e1dc0f5e84268fcfd6ca
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fedb1562ed183d033e759b5e36068e204e2b6058cb4f0b41f5984ba8c23f28b5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0DD1D372A1CE8185D7208B15E8507BAB7A1F789BE4F045275EA8E83B9ADF3CD455CF00
                                                                                                                                                                                                                                                  Function 00007FF81F2A8890 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 150COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF81F2A89C2
                                                                                                                                                                                                                                                  • _mktime64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF81F2A89D3
                                                                                                                                                                                                                                                  • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF81F2A89DC
                                                                                                                                                                                                                                                  • LeaveCriticalSection.KERNEL32 ref: 00007FF81F2A89EB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A028D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02BB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02C9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A036B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A037E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A038F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$CriticalErrorLastLeaveProcessSectionValue_errno$_mktime64
                                                                                                                                                                                                                                                  • String ID: present$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2062418933-3155596268
                                                                                                                                                                                                                                                  • Opcode ID: 4d54065f4b53420449b1ff84fe6e235e08a5e53a9c0398b97c2a75346a31c1de
                                                                                                                                                                                                                                                  • Instruction ID: 5d348dd70624edab6bf501df311d2ae71eff272921d979fa90b376d46b7b85a3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4d54065f4b53420449b1ff84fe6e235e08a5e53a9c0398b97c2a75346a31c1de
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1651E672A18B4687E754CF28D84126977A0FB887A4F444335EA5D8BBD6EF3CE5118B00
                                                                                                                                                                                                                                                  Function 00007FF81F1616D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument$category
                                                                                                                                                                                                                                                  • API String ID: 1318908108-2068800536
                                                                                                                                                                                                                                                  • Opcode ID: c31e599aff6ce8fd118d7930930d13bb61e4023c7ccaaddb711cf16cebfbc0cd
                                                                                                                                                                                                                                                  • Instruction ID: d602c783e9dc7f6c1b3a732b1a81fc881ea6c3d030331e89c618525a2434f323
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c31e599aff6ce8fd118d7930930d13bb61e4023c7ccaaddb711cf16cebfbc0cd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1851C562B19E9682FF5B8B06F4602B833A5EB84BF5F441235DA8E57794DF6CE851C300
                                                                                                                                                                                                                                                  Function 00007FF81F4A1E30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: printf
                                                                                                                                                                                                                                                  • String ID: focus cleared after %s died$forwarding focus to %s after %s died$releasing focus to root after %s died
                                                                                                                                                                                                                                                  • API String ID: 3524737521-3504952018
                                                                                                                                                                                                                                                  • Opcode ID: aed2d57de07a5d37f97fb9204d8ed0dd5f7b958d39045c27056f24617ce957fc
                                                                                                                                                                                                                                                  • Instruction ID: 56896291e1ac36b9f1b9f92a7cbbad004c1121170ae8bb5cd3d25365a37a992f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: aed2d57de07a5d37f97fb9204d8ed0dd5f7b958d39045c27056f24617ce957fc
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F518C72609F8281EB648F21E4407A977A4FB84BE4F048635EF9E47B94DF38E461C708
                                                                                                                                                                                                                                                  Function 00007FF81F161000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 106COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument$bidirectional
                                                                                                                                                                                                                                                  • API String ID: 1318908108-2110215792
                                                                                                                                                                                                                                                  • Opcode ID: 2be184d8cc6ee1ee00809d45acc887d572eb9887141ab2374770304697e252f3
                                                                                                                                                                                                                                                  • Instruction ID: a5c3357d82495967c0008ca0ac84013d05cc9d0d71f14470725575dd9d3aee33
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2be184d8cc6ee1ee00809d45acc887d572eb9887141ab2374770304697e252f3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1418062B1CE9282FF5B8B15E4513793361EB44BF0F841235DA5E97794DFADE8918300
                                                                                                                                                                                                                                                  Function 00007FF81F450040 Relevance: 10.6, APIs: 7, Instructions: 66windowCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: ModePalette$DeleteObjectRealizeReleaseSelect
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3511821735-0
                                                                                                                                                                                                                                                  • Opcode ID: 44490bb2eedf07de0f0a93b270647fcd6f2e883f4a4dddcb82cd56644a364d9b
                                                                                                                                                                                                                                                  • Instruction ID: 2e11349920860c9b3b39e54ec2f93573ae7639e96f738bdbecde64c9e5a8715d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 44490bb2eedf07de0f0a93b270647fcd6f2e883f4a4dddcb82cd56644a364d9b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AE210C35A08A4186EA14DB16F8401AA73A1FB89FE0F144231EE8D47B29CF3CE193CB44
                                                                                                                                                                                                                                                  Function 00007FF81F161150 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _PyArg_CheckPositional.PYTHON312 ref: 00007FF81F1636E7
                                                                                                                                                                                                                                                  • _PyArg_BadArgument.PYTHON312 ref: 00007FF81F16371A
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F1611B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF81F1611E2
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F1611B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF81F1611FA
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F1611B0: PyType_IsSubtype.PYTHON312 ref: 00007FF81F16121D
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_CompareStringUnicode_With$ArgumentCheckPositionalSubtypeType_
                                                                                                                                                                                                                                                  • String ID: argument 1$argument 2$normalize$str
                                                                                                                                                                                                                                                  • API String ID: 4101545800-1320425463
                                                                                                                                                                                                                                                  • Opcode ID: 6a3206665d50624963465f038f79663c2d3d68664346081dad0779ef5a43a2b4
                                                                                                                                                                                                                                                  • Instruction ID: b9062f2e5937c5225f1dac59b4b709c8a7d9f8d7a6b032b2302b16cf67f9a762
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6a3206665d50624963465f038f79663c2d3d68664346081dad0779ef5a43a2b4
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D118BA1B08E8680FA528B16F8806B93360AB44FF4F988236D90D0B794DFACD585D340
                                                                                                                                                                                                                                                  Function 00007FF81F164870 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                                                  • String ID: argument 1$argument 2$is_normalized$str
                                                                                                                                                                                                                                                  • API String ID: 3876575403-184702317
                                                                                                                                                                                                                                                  • Opcode ID: 7c950a274d1c530a4e2b2ee5c75bc666441a244dd8d061769435580234d1272f
                                                                                                                                                                                                                                                  • Instruction ID: db61810bc6554525a595fb681687933c58b477d5dc2eb713910727529d750b62
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7c950a274d1c530a4e2b2ee5c75bc666441a244dd8d061769435580234d1272f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6801AD61F08E8694FB528B46F490AB53361AB48FF4F849235D94E0B654DFACD489C300
                                                                                                                                                                                                                                                  Function 00007FF81F4B4010 Relevance: 9.1, APIs: 6, Instructions: 111COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF81F4B3BE1), ref: 00007FF81F4B4043
                                                                                                                                                                                                                                                  • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF81F4B3BE1), ref: 00007FF81F4B4056
                                                                                                                                                                                                                                                  • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF81F4B3BE1), ref: 00007FF81F4B4084
                                                                                                                                                                                                                                                  • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF81F4B3BE1), ref: 00007FF81F4B40D5
                                                                                                                                                                                                                                                  • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF81F4B3BE1), ref: 00007FF81F4B4117
                                                                                                                                                                                                                                                  • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF81F4B3BE1), ref: 00007FF81F4B4167
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: isspace
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3785662208-0
                                                                                                                                                                                                                                                  • Opcode ID: 35e145db685ce273285fc17d4865c1be36b76f72ea80924c7aefada051b6bfee
                                                                                                                                                                                                                                                  • Instruction ID: 9a0b4cb82981972cdc9d4cde3b9f8bc3ab88a42aa026d95d5e581060a86fc29d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 35e145db685ce273285fc17d4865c1be36b76f72ea80924c7aefada051b6bfee
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 84419132A08E8292EB644F29989427927A4FB65BF4F184331DB9D436F6CF2DD5A5C300
                                                                                                                                                                                                                                                  Function 00007FF81F449F02 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 106stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strcmp
                                                                                                                                                                                                                                                  • String ID: -xpstyle$@Q$option$unicode$utf-16
                                                                                                                                                                                                                                                  • API String ID: 1004003707-4247030715
                                                                                                                                                                                                                                                  • Opcode ID: e674ac6053932bc2219dcbe53f09a6e74a3e51078cd40869430b8ce4603097fd
                                                                                                                                                                                                                                                  • Instruction ID: 1b822241caf11f4ff0781bf5a4fd10dc5daac73162e5ebf26c2a2474639a3e63
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e674ac6053932bc2219dcbe53f09a6e74a3e51078cd40869430b8ce4603097fd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DD512CB6A09F86C2EB248B15E8542BA77A4FB88BE4F448236DA4E53765DF3CD0558700
                                                                                                                                                                                                                                                  Function 00007FF81F465E37 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CapsDevice$Release
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1035833867-0
                                                                                                                                                                                                                                                  • Opcode ID: da919b167b2d2db880862a623c689a940f5d39462a6c82fd7a135c5151f8cbab
                                                                                                                                                                                                                                                  • Instruction ID: 9768819c49f8ca068e221ec378f5bc21ae272dfa2c82e17c30f74bc59c4b3ad0
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: da919b167b2d2db880862a623c689a940f5d39462a6c82fd7a135c5151f8cbab
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1214F76A18A0187DB289F69E45027D73A1FB84BB1F404139DA4F47B91DF3CE496CB00
                                                                                                                                                                                                                                                  Function 00007FF81F2AA700 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 118COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _errno
                                                                                                                                                                                                                                                  • String ID: ?dirName?$POSIX$couldn't change working directory to "%s": %s$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2918714741-3219823474
                                                                                                                                                                                                                                                  • Opcode ID: 85082b158252c038a4f361c17d5fdf77d14c6061ac8ab77806eb20ae8b140e14
                                                                                                                                                                                                                                                  • Instruction ID: b461b9e6b7ee1afbb5b5371eb91730ab077238a8b7006055c7ef0061b8d140bc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 85082b158252c038a4f361c17d5fdf77d14c6061ac8ab77806eb20ae8b140e14
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6B41D131A08E4285EB54AF22E4113BE63A1EF85BE4F484234DE4D4FB96DE7DE446CB40
                                                                                                                                                                                                                                                  Function 00007FF81F39CF70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _finite.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,00000000,00007FF81F29E9F4), ref: 00007FF81F39CF90
                                                                                                                                                                                                                                                  • frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,00000000,00007FF81F29E9F4), ref: 00007FF81F39D03B
                                                                                                                                                                                                                                                  • memset.VCRUNTIME140 ref: 00007FF81F39D06B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A028D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02BB
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A02C9
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A036B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A037E
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F3A0280: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF81F311924), ref: 00007FF81F3A038F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$ErrorLastProcessValue$CriticalLeaveSection_finitefrexpmemset
                                                                                                                                                                                                                                                  • String ID: unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 2520627744-2759121943
                                                                                                                                                                                                                                                  • Opcode ID: d0618fa1b676a11b60be0806bff10880395f3da061906316fb8ec850767daaf8
                                                                                                                                                                                                                                                  • Instruction ID: 5a5e3369566cbca63eb4455691cc48dc4bed3ea672a7d55ebfc2e652aa6bbad4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0618fa1b676a11b60be0806bff10880395f3da061906316fb8ec850767daaf8
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5031A6A2E08F4281F7109F35A8561BAA7A0BF95BE4F148331D94D9F75ADE7CE4428740
                                                                                                                                                                                                                                                  Function 00007FF81F16479C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_ArgumentSubtypeType_
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument$east_asian_width
                                                                                                                                                                                                                                                  • API String ID: 1522575347-3913127203
                                                                                                                                                                                                                                                  • Opcode ID: 7b891638b4a45313673a93616f0d216ddcfc167a757208e07fea525010fbe4c5
                                                                                                                                                                                                                                                  • Instruction ID: 13d0058903245b517c43b5cf62722b337be6a35d141e8ea002d6f7203f836576
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7b891638b4a45313673a93616f0d216ddcfc167a757208e07fea525010fbe4c5
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9721DE22E08E8281FB4B8B52B45017837A2FF94BF0F448239DA0D03754DFACE891C300
                                                                                                                                                                                                                                                  Function 00007FF81F164D6C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
                                                                                                                                                                                                                                                  • String ID: not a numeric character
                                                                                                                                                                                                                                                  • API String ID: 1034370217-2058156748
                                                                                                                                                                                                                                                  • Opcode ID: 8a252d4494416c01de2789638a4ecad70e8503ee6f61509ac703bcac1011aaf0
                                                                                                                                                                                                                                                  • Instruction ID: e942305da33255835da7c0006223341a0e4e535c8c8906fe60bb07562dd3b9a3
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8a252d4494416c01de2789638a4ecad70e8503ee6f61509ac703bcac1011aaf0
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6621A221E4CD42C6FB538B25F41013877A2AF64BF4F048330D91E47658DFACE8958340
                                                                                                                                                                                                                                                  Function 00007FF81F164448 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
                                                                                                                                                                                                                                                  • String ID: not a decimal
                                                                                                                                                                                                                                                  • API String ID: 3750391552-3590249192
                                                                                                                                                                                                                                                  • Opcode ID: 30abf5ee6eb06e173e75edeec379c503cf6988d9432b31e93c7c03d97c2bbd6f
                                                                                                                                                                                                                                                  • Instruction ID: 26bfd9492be121fa9fc04ff9a9d40806a5061ee0e41960cf27dd3fd5e957ec1e
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 30abf5ee6eb06e173e75edeec379c503cf6988d9432b31e93c7c03d97c2bbd6f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94117325B4CE4282FB578B25F45523937E2AFA4BF4F488634CA4E47758DFACE8419340
                                                                                                                                                                                                                                                  Function 00007FF81F164B70 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$name
                                                                                                                                                                                                                                                  • API String ID: 3876575403-4190364640
                                                                                                                                                                                                                                                  • Opcode ID: ab7f7404489c6aefaed3bb65c109ab607c61dcc8bacd4a48ace643e301676b9f
                                                                                                                                                                                                                                                  • Instruction ID: ac4d8a0e2d32d9933fa373dd4837feb076390741e0c6d7cbe0d3affb7eaf2ff1
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ab7f7404489c6aefaed3bb65c109ab607c61dcc8bacd4a48ace643e301676b9f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CD118835B08E8281FB529B42F4802A933A1EB89BF4F588636DE0D47755DFBDE586C300
                                                                                                                                                                                                                                                  Function 00007FF81F164CB4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$numeric
                                                                                                                                                                                                                                                  • API String ID: 3876575403-2385192657
                                                                                                                                                                                                                                                  • Opcode ID: f2c4218ba94db24fb659ccbfd3ee4767c89f092abad47c48dbe9f437d0b50517
                                                                                                                                                                                                                                                  • Instruction ID: c9cacd7f5f751026f7ec625114fe855ab2cf2d22bfc12321ba06aa7b30560952
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f2c4218ba94db24fb659ccbfd3ee4767c89f092abad47c48dbe9f437d0b50517
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4F118C31F08E4285FA529B46F4402A93361EB95FF8F588236DE1D47769CFADE586C300
                                                                                                                                                                                                                                                  Function 00007FF81F164390 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_$ArgumentCheckPositional
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument 1$decimal
                                                                                                                                                                                                                                                  • API String ID: 3876575403-2474051849
                                                                                                                                                                                                                                                  • Opcode ID: d3484de5ee44d7a33ec5e53d5364025946576caca118cb4f9bd9e3e7fb1b6d42
                                                                                                                                                                                                                                                  • Instruction ID: 498ef3e3e05988be15eee42dfa0d8916eaa0382a4e135397af82744869c75564
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d3484de5ee44d7a33ec5e53d5364025946576caca118cb4f9bd9e3e7fb1b6d42
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 42118821B08E5285FA529B42F4812A93361EB94FF4F988236DE4D47769DFBCE596C300
                                                                                                                                                                                                                                                  Function 00007FF81F1642A4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_ArgumentErr_Occurred
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument$combining
                                                                                                                                                                                                                                                  • API String ID: 3979797681-4202047184
                                                                                                                                                                                                                                                  • Opcode ID: f57a56bca3f03315399802cbb188705c8f0221a3905f8c719d86b24713be5e96
                                                                                                                                                                                                                                                  • Instruction ID: 837d6da58d5d101c7f6c454a1ebb7a04bf90172e2b7fdae24f6fffcf36db6278
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f57a56bca3f03315399802cbb188705c8f0221a3905f8c719d86b24713be5e96
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 74017C61E08E4282FA2B9B55B8501B933A1FF497F8F900739D94D47295DFACE595C300
                                                                                                                                                                                                                                                  Function 00007FF81F164A7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Arg_ArgumentErr_Occurred
                                                                                                                                                                                                                                                  • String ID: a unicode character$argument$mirrored
                                                                                                                                                                                                                                                  • API String ID: 3979797681-4001128513
                                                                                                                                                                                                                                                  • Opcode ID: 9496c058ca4f3a92d16c11e0dea8752c802f91a4b5f675f0277ed2c6365c313a
                                                                                                                                                                                                                                                  • Instruction ID: f1c6e28c68ab5b1d2ef6d784e46cbc313a4d38c7d5f6705435f13d343912c888
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 9496c058ca4f3a92d16c11e0dea8752c802f91a4b5f675f0277ed2c6365c313a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 00015A60E08E4296FA2B9B16F8501B933A1BF4CBF8F940735D51E47291DFACE584C300
                                                                                                                                                                                                                                                  Function 00007FF81F162610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Mem_$Capsule_Err_FreeMallocMemory
                                                                                                                                                                                                                                                  • String ID: unicodedata._ucnhash_CAPI
                                                                                                                                                                                                                                                  • API String ID: 3673501854-3989975041
                                                                                                                                                                                                                                                  • Opcode ID: 04962b3129ec8039d4574c2b15526bc82bf072c2335504b47079f601afa57e40
                                                                                                                                                                                                                                                  • Instruction ID: a44fe9cebdbc0f98c6b58f992a490fdd1bac5815278474a6f53f303f3af7fa49
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 04962b3129ec8039d4574c2b15526bc82bf072c2335504b47079f601afa57e40
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BCF03C20A19F8395FE1B8B11B8141B573A4BF48BF4F481631C84E06368EFBCE048C300
                                                                                                                                                                                                                                                  Function 00007FF81F360F10 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 336COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,::oo::define,00000001,?,00000000), ref: 00007FF81F36128B
                                                                                                                                                                                                                                                  • TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,::oo::define,00000001,?,00000000), ref: 00007FF81F361365
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Value$AllocHeap$ErrorLastProcess
                                                                                                                                                                                                                                                  • String ID: ::oo::Obj%d$::oo::define$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 827889809-1942930302
                                                                                                                                                                                                                                                  • Opcode ID: 889572c27ca12a3192a37a8c4a1bd413c26d0b14cc46699e983a7a6e1239c594
                                                                                                                                                                                                                                                  • Instruction ID: 51945033971ea2348d5c2398dad3e5446e2e1106ebf622858a0be4fbb6fcc932
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 889572c27ca12a3192a37a8c4a1bd413c26d0b14cc46699e983a7a6e1239c594
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C5E15A32A09F4285EB04AF15E4503A9B3A0FB95FE8F584235DA4E4B7A5DF3CE591C340
                                                                                                                                                                                                                                                  Function 00007FF81F305850 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 288COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,Unable to create namespace for package configuration.,00007FF81F2F73F3), ref: 00007FF81F30598F
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                                                  • String ID: Unable to create namespace for package configuration.$Unable to create query command for package configuration$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3510742995-719066905
                                                                                                                                                                                                                                                  • Opcode ID: 32d95f17f9926df62c3baea7fc36c9c0cf68b1b6a2240842fb61f98ebb7faf15
                                                                                                                                                                                                                                                  • Instruction ID: 4637caa34d6b19fc4a8e43495a7084e286344356c50acc480d3b4db904785181
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 32d95f17f9926df62c3baea7fc36c9c0cf68b1b6a2240842fb61f98ebb7faf15
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 40C17F36608B8186EB71CF15E48076AB7A4FB84BE4F548226DE8E47B98DF3CD454CB40
                                                                                                                                                                                                                                                  Function 00007FF81F454090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: DeleteObject
                                                                                                                                                                                                                                                  • String ID: unicode$utf-16
                                                                                                                                                                                                                                                  • API String ID: 1531683806-3317161374
                                                                                                                                                                                                                                                  • Opcode ID: 6d530817e8705c48cf8a2ca7bf30b92cab0ee6c3e4b05de6f94e6b405e36136f
                                                                                                                                                                                                                                                  • Instruction ID: 7d92e551a241ec0a0bfbda195fb792e6283e891fa437c70368469a4b0252724c
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6d530817e8705c48cf8a2ca7bf30b92cab0ee6c3e4b05de6f94e6b405e36136f
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94414876B0AF8681EE489B16E96427927B5FB84BE0F049231CA4E07B75DF3CE4658300
                                                                                                                                                                                                                                                  Function 00007FF81F161ED0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • PyErr_SetString.PYTHON312(?,?,?,?,?,00007FF81F161EBC), ref: 00007FF81F163C1F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F161FB0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81F161FE8
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F161FB0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF81F162006
                                                                                                                                                                                                                                                  • PyErr_Format.PYTHON312 ref: 00007FF81F161F33
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Err_strncmp$FormatString
                                                                                                                                                                                                                                                  • String ID: name too long$undefined character name '%s'
                                                                                                                                                                                                                                                  • API String ID: 3882229318-4056717002
                                                                                                                                                                                                                                                  • Opcode ID: 1035d3c545dcad7f3fc1fcdb04c9696ab0948ab795443172b9eb40205ee2c5c7
                                                                                                                                                                                                                                                  • Instruction ID: 140aa5b886c1a12eadf034a17d7c981c7f2b60eb4506d3344d66e5c28b282c1b
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1035d3c545dcad7f3fc1fcdb04c9696ab0948ab795443172b9eb40205ee2c5c7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C511FE76A19D47D1FB028B14F8946B47361FB98BF9F840635CA0D472A4DFADD14AC740
                                                                                                                                                                                                                                                  Function 00007FF81F4EE080 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 297COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                                                  • String ID: TextFetchSelection couldn't find end of range$TkBTreeLinesTo couldn't find line$TkBTreeLinesTo couldn't find node
                                                                                                                                                                                                                                                  • API String ID: 3510742995-2156555518
                                                                                                                                                                                                                                                  • Opcode ID: 7a34cc2417ced1db10ad9dd734b69d9c8b3c98d8ddb68fe41ad4bac85aa02189
                                                                                                                                                                                                                                                  • Instruction ID: 901fa301ac6cddd31f7d19573d2a70175d192f13c884e707d7cfd0e2e03085ea
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7a34cc2417ced1db10ad9dd734b69d9c8b3c98d8ddb68fe41ad4bac85aa02189
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 87D1D132A08E8682EB608F15D840BB967A1FF58BD4F0A9631DE4D47656DF3CE4D5CB40
                                                                                                                                                                                                                                                  Function 00007FF81F3A58F0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 247COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                                                  • String ID: Cannot trace a variable with no name$access$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3510742995-547519528
                                                                                                                                                                                                                                                  • Opcode ID: d92890f004fbc32b820b057c5ef467e92a38d6f8a96c03495c1f30de8f4116a7
                                                                                                                                                                                                                                                  • Instruction ID: f7a67eb1fa7b2d0b2aeaefca9a0a06cd2d1e320700e382f27d89c98429f1a817
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d92890f004fbc32b820b057c5ef467e92a38d6f8a96c03495c1f30de8f4116a7
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F5918372A08E8185EA959F16E880779A7A0FF94BE4F488335EE5D8BBD5DF3CD4418700
                                                                                                                                                                                                                                                  Function 00007FF81F394850 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 191COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF81F3922E8,?,?,...,00007FF81F391EC6), ref: 00007FF81F394A0C
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeap$ErrorLastProcessValuememcpy
                                                                                                                                                                                                                                                  • String ID: ...$max length for a Tcl unicode value (%d chars) exceeded$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 1456920652-2201900064
                                                                                                                                                                                                                                                  • Opcode ID: a707dfc67f39489b6192174b749b40216d47a48474270974a8eb74faf2f0a1eb
                                                                                                                                                                                                                                                  • Instruction ID: fd19ed4aa00bb6c4eff0b5f02091549e68b7da53ae465c9add52bd09bcd40357
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a707dfc67f39489b6192174b749b40216d47a48474270974a8eb74faf2f0a1eb
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0661B072A08B4286EB249F15E54027D77A0FB487E4F548239DBAE4BB95DF3CE852C700
                                                                                                                                                                                                                                                  Function 00007FF81F161FB0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                                                                  • API String ID: 1114863663-87138338
                                                                                                                                                                                                                                                  • Opcode ID: 8c364d9f7697f15a55bc755bfe662b8d9c35c3fd34f27cade82d87210dead623
                                                                                                                                                                                                                                                  • Instruction ID: fdc5de1f184694a5facf62f0f1bcada8488d3ffd16ae8786ef49fcb95b5b0c89
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8c364d9f7697f15a55bc755bfe662b8d9c35c3fd34f27cade82d87210dead623
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: CE61F672B18A8146FA638A15B8006BA7252FB84BF0F548335EA9D47BC9DFBDD501C700
                                                                                                                                                                                                                                                  Function 00007FF81F2A2F20 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE21
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE4F
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE5D
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FE9B
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F39FC10: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF81F3A047E), ref: 00007FF81F39FEA9
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F2A2F6A
                                                                                                                                                                                                                                                  • memcpy.VCRUNTIME140 ref: 00007FF81F2A304A
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: AllocHeapmemcpy$ErrorLastProcessValue
                                                                                                                                                                                                                                                  • String ID: max size for a Tcl value (%d bytes) exceeded$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3659710978-3185694872
                                                                                                                                                                                                                                                  • Opcode ID: 564f54229223d04b4104d77dbea23e6b7e5024a9be35b2c0d661f5c0760282fd
                                                                                                                                                                                                                                                  • Instruction ID: 11c9d7b6b5df702b78c3fbcad8168fbb330040dc9a5b06defb2b3dbeaac358d9
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 564f54229223d04b4104d77dbea23e6b7e5024a9be35b2c0d661f5c0760282fd
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 00411632A08B9186EB108F11E44017A77A4FB557E4F148235EB9D4BBD9DF7ED862C740
                                                                                                                                                                                                                                                  Function 00007FF81F391890 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 80COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                                                                                                  • String ID: %s called with shared object$Tcl_SetStringObj$unable to alloc %u bytes
                                                                                                                                                                                                                                                  • API String ID: 3510742995-521981002
                                                                                                                                                                                                                                                  • Opcode ID: c95ca6175937c5d19de628020fe44ef0abd4f1f140c228410f9d951d1fb6a169
                                                                                                                                                                                                                                                  • Instruction ID: c6d8fd3eacd5c1fff2ddaa8db8f531dfaf2734d476f1c714dc551bbd00ad940f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c95ca6175937c5d19de628020fe44ef0abd4f1f140c228410f9d951d1fb6a169
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A318D72A09F4686EB64AF15E88017A63A0FF507E4F184339DBAD4B7A5DF3CE4508340
                                                                                                                                                                                                                                                  Function 00007FF81F3A00B0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                                  • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage
                                                                                                                                                                                                                                                  • API String ID: 0-4238949377
                                                                                                                                                                                                                                                  • Opcode ID: 6f1fa3e76018eae98ed769c8c7148b88fbfe3805b4be2c578eac8c37aadc92b9
                                                                                                                                                                                                                                                  • Instruction ID: ce1ad105061f9f99b1a0a1ac9628cc5478cfe1854f6f966d3e2f591019357905
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f1fa3e76018eae98ed769c8c7148b88fbfe3805b4be2c578eac8c37aadc92b9
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5D01D821F08E5285FF15DB65AC505B873A0AF543E4F040330D94D8DA95EF3CA8528700
                                                                                                                                                                                                                                                  Function 00007FF81F29F800 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _isnan.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F29F814
                                                                                                                                                                                                                                                  • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F29F839
                                                                                                                                                                                                                                                  • _finite.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F29F852
                                                                                                                                                                                                                                                  • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F29F85C
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F323760: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F323775
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F323760: _isnan.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F323787
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F323760: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F323795
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F323760: _finite.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F3237A3
                                                                                                                                                                                                                                                    • Part of subcall function 00007FF81F323760: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF81F29F829,?,?,?,?,00000000,00007FF81F29AA57), ref: 00007FF81F3237AD
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: _errno$_finite_isnan
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 3696783373-0
                                                                                                                                                                                                                                                  • Opcode ID: 40179a4b382254e2b69ea8d10b23f8a09acd07daba44ea24e6b6f3ba4fce1245
                                                                                                                                                                                                                                                  • Instruction ID: 77fa6e6cbd72330bb6a7ea5d4e509904884d3f1926c670aa032d1dd8f07cee91
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 40179a4b382254e2b69ea8d10b23f8a09acd07daba44ea24e6b6f3ba4fce1245
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0B01F790E18F4A81F6E21B3494026FA93D07F697EAF095330E94D1A1B2EF2CB4D78900
                                                                                                                                                                                                                                                  Function 00007FF81F162BEC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 2933794660-0
                                                                                                                                                                                                                                                  • Opcode ID: 109ceed06940f0f17d4484f54d46a13cc3e2d9acbfc7514a401e54a12864ff88
                                                                                                                                                                                                                                                  • Instruction ID: 82acddd74c78d0c6ac9e18cd7ff1fa764775cab20d08a59ff3e9c08f1553c09f
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 109ceed06940f0f17d4484f54d46a13cc3e2d9acbfc7514a401e54a12864ff88
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 78111C26B14F018AFB018F60E8542A833A4FB597A8F441A31DA6D867A4DF78E1548780
                                                                                                                                                                                                                                                  Function 00007FF81F481FCC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 36stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: USAGE$can't specify both -file and -channel$monochrome
                                                                                                                                                                                                                                                  • API String ID: 1114863663-3063129647
                                                                                                                                                                                                                                                  • Opcode ID: ee432efd05150fb423a4b6a01d6aaacfc2e1813a0624a59d5299ab59b97ba8ed
                                                                                                                                                                                                                                                  • Instruction ID: 2f5d43dab16d92af85e62fb773fe489fb063b4568c939a0b6125457a88125fe5
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee432efd05150fb423a4b6a01d6aaacfc2e1813a0624a59d5299ab59b97ba8ed
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 38115EA1E08E4398FB558BA0A8543B827A0EF457F8F140336CA2E461E8DF3C9595C300
                                                                                                                                                                                                                                                  Function 00007FF81F481FFD Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: USAGE$can't specify both -file and -channel$monochrome
                                                                                                                                                                                                                                                  • API String ID: 1114863663-3063129647
                                                                                                                                                                                                                                                  • Opcode ID: b674ac22a3d2cc94870d6f7ca02447d0397f48d2e1a1346799e6f553c8dc373b
                                                                                                                                                                                                                                                  • Instruction ID: ac35b6f9d85dcc823ff4ce9982a4da4ca9c198620c261cee8564756258eb2a2d
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b674ac22a3d2cc94870d6f7ca02447d0397f48d2e1a1346799e6f553c8dc373b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2E0140A1E08E4398FB558FA5A8443F827A0AB557F8F185335DA2E865E8DF3CE545C300
                                                                                                                                                                                                                                                  Function 00007FF81F481FF6 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 32stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: USAGE$can't specify both -file and -channel$monochrome
                                                                                                                                                                                                                                                  • API String ID: 1114863663-3063129647
                                                                                                                                                                                                                                                  • Opcode ID: 8717231d908443e25c93b89c530ca940117f35b3125a9befa527314cf63da6ff
                                                                                                                                                                                                                                                  • Instruction ID: d8440872beff3b437ec1a347389710a9931f9e46e4e274497a4754828b5e47fc
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8717231d908443e25c93b89c530ca940117f35b3125a9befa527314cf63da6ff
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1E015EA1E08E4398FB518BA5A8403F823A0AF55BF8F185336CA2F465E8DF3CA545C301
                                                                                                                                                                                                                                                  Function 00007FF81F482009 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30stringCOMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: strncmp
                                                                                                                                                                                                                                                  • String ID: USAGE$can't specify both -file and -channel$monochrome
                                                                                                                                                                                                                                                  • API String ID: 1114863663-3063129647
                                                                                                                                                                                                                                                  • Opcode ID: 57a93220ab0a8f3a8e76bd33af17c1d138d2c92721b4d3cd229d9456d6caee5a
                                                                                                                                                                                                                                                  • Instruction ID: 446fe606e0d13ba42f696500eff4bcbde0678b5ce96bb82086b9145a02b79077
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 57a93220ab0a8f3a8e76bd33af17c1d138d2c92721b4d3cd229d9456d6caee5a
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DB011EA1E08E4398EB558BA5A8543F827A0AB55BF8F185336CA2E465E8DF3C9545C301
                                                                                                                                                                                                                                                  Function 00007FF81F164C28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: String$Err_FromUnicode_
                                                                                                                                                                                                                                                  • String ID: no such name
                                                                                                                                                                                                                                                  • API String ID: 3678473424-4211486178
                                                                                                                                                                                                                                                  • Opcode ID: 3005c2e76ccdbfdbb1504f9de79cdf15a2dc4c168f6a8fbb72cf26d2d18b7585
                                                                                                                                                                                                                                                  • Instruction ID: bbf7277163c981c8dd6d20df424a2be524fa1ff86ab369583ec9fdd0140fc535
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3005c2e76ccdbfdbb1504f9de79cdf15a2dc4c168f6a8fbb72cf26d2d18b7585
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 55014F75A18E4296FB638B25F8547B933A0BF98BF8F400231DA4E86394EF6CE0058700
                                                                                                                                                                                                                                                  Function 00007FF81F1625A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  • _PyObject_GC_New.PYTHON312(?,?,00000000,00007FF81F162513), ref: 00007FF81F1625A6
                                                                                                                                                                                                                                                  • PyObject_GC_Track.PYTHON312(?,?,00000000,00007FF81F162513), ref: 00007FF81F1625D8
                                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548290080.00007FF81F161000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FF81F160000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548266438.00007FF81F160000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F165000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F1C2000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F20E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F212000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F217000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548315078.00007FF81F26F000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548525104.00007FF81F272000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548548992.00007FF81F274000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f160000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: Object_$Track
                                                                                                                                                                                                                                                  • String ID: 3.2.0
                                                                                                                                                                                                                                                  • API String ID: 16854473-1786766648
                                                                                                                                                                                                                                                  • Opcode ID: 05fdb2ae452a8d6f4b3be3f11c3efdbfda8cc49ab31c9f152460280c20d50ee3
                                                                                                                                                                                                                                                  • Instruction ID: e5cf3950b6d424b025c4209db1a8374a09b0126ff63c086d49c321a51142c752
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 05fdb2ae452a8d6f4b3be3f11c3efdbfda8cc49ab31c9f152460280c20d50ee3
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BBE0E564A19F4692FE278F11B8540A833A8BF48BB4B580635CD4C02324EFBCE5A4C240
                                                                                                                                                                                                                                                  Function 00007FF81F4AFF30 Relevance: 5.1, APIs: 4, Instructions: 110COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548816001.00007FF81F441000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF81F440000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548791269.00007FF81F440000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548895785.00007FF81F53F000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548936678.00007FF81F58B000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548964155.00007FF81F58C000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549065911.00007FF81F590000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549090713.00007FF81F591000.00000008.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549150451.00007FF81F593000.00000004.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2549175437.00007FF81F595000.00000002.00000001.01000000.00000019.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f440000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpymemset
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 1297977491-0
                                                                                                                                                                                                                                                  • Opcode ID: b881d419e223d39fe836a36bdf1888140deef11a0747f9838951f222f3b7755b
                                                                                                                                                                                                                                                  • Instruction ID: 9d324211ee11e5d345a0b21924abe306dfae67c4fbfeb631c652a1d1c309d9c4
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b881d419e223d39fe836a36bdf1888140deef11a0747f9838951f222f3b7755b
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 384188B6704B8AC2DB548F5AE8800697BAAFB8CFE17154126EF4D03756CF38D459C700
                                                                                                                                                                                                                                                  Function 00007FF81F2A38E0 Relevance: 5.1, APIs: 4, Instructions: 103COMMON
                                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                                  • Source File: 00000008.00000002.2548598085.00007FF81F281000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF81F280000, based on PE: true
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548572969.00007FF81F280000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548697409.00007FF81F3E3000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548737254.00007FF81F428000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  • Associated: 00000008.00000002.2548762360.00007FF81F42B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7ff81f280000_zed.jbxd
                                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                                  • API ID: memcpy$memset
                                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                                  • API String ID: 438689982-0
                                                                                                                                                                                                                                                  • Opcode ID: e7e59d6e42731bd32482170abdb8953954c790e3ad1fee50091eca55926447b2
                                                                                                                                                                                                                                                  • Instruction ID: e00600a34ab07c4d09214b11ee0bf5e049eaf9f7c140b06dc2ccc9494b35485a
                                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e7e59d6e42731bd32482170abdb8953954c790e3ad1fee50091eca55926447b2
                                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F241B422F09E5689FB608F64D5803BC63B2AB44BE4F444635DE4E67BD9DE7ED8018340